VERY IMPORTANT

Only a few details are known so far but what we have found is that the file delivered is a VBE file (encoded VBS) named “SCANSIONE.vbe” and is delivered via ZIP attachments in emails with the subject suggesting different documents in Italian. The attackers also seem to be operating from well-known Italian web email services such as: tiscali.it, pec.it, libero.it and more.