Loading story…
Italian investigators tied the EyePyramid cyber-espionage operation to Giulio Occhionero and Francesca Maria Occhionero after uncovering a long-running spear-phishing campaign that compromised prominent figures across Italy’s political, financial, legal, academic, religious, and institutional sectors. Authorities reported more than 100 active victims on the malware server and indications that roughly 16,000 people may have been targeted over several years, with command-and-control evidence placing activity from at least 2014 to 2016 and possible malware development dating back to 2008. The operation reportedly stole tens of gigabytes of data by sending malicious attachments in low-sophistication phishing emails and harvesting files from infected systems.
Technical analysis showed EyePyramid was a .NET implant protected with heavy obfuscation and anti-debugging and anti-virtual-machine checks, while maintaining persistence through Run and RunOnce registry keys. The malware attempted to weaken host defenses by altering firewall rules, changing folder permissions, disabling UAC, and interfering with security tools, then encrypted strings and exfiltrated data with 3DES using host-dependent keys. Stolen data was sent mainly through SMTP and IMAP attachments, with additional WebDAV and HTTP support, and the implant could authenticate to command-and-control servers to download files while also containing code related to Active Directory and LDAP privilege operations.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Italian authorities arrested Giulio Occhionero and Francesca Maria Occhionero as suspects in the EyePyramid espionage operation.
Italian police declassified a court order on a chain of EyePyramid cyberattacks against senior Italian government members and institutions. The order documented more than 100 active victims and indications of roughly 16,000 targets over several years.
Command-and-control evidence cited in the investigation showed the known EyePyramid campaign lasted until August 2016.
Evidence from command-and-control servers indicated the EyePyramid espionage campaign had been active since at least March 2014, targeting prominent Italian figures through spear-phishing emails with malicious attachments.
Researchers identified two initial EyePyramid-related Win32 PE samples via YARA, with compilation timestamps in September 2010 and November 2010.
Securelist reported that the EyePyramid malware may have been developed and possibly used as early as 2008, based on the investigation's findings.
Cisco Talos released a technical analysis of the .NET-based EyePyramid implant, describing its obfuscation, anti-analysis features, persistence mechanisms, defense-evasion behavior, and exfiltration methods.
Securelist published details of the EyePyramid attacks, including command-and-control domains, exfiltration email addresses, sample hashes, phishing lure filenames, and YARA-based identification results for related malware samples.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 218 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple phishing-driven campaigns to **HawkEye** and related surveillance malware, describing a long-running credential-theft threat that targeted organizations across dozens of countries and industries. The malware was delivered through lures such as airline ticket confirmations and fake payment documents, often inside compressed archives or executable attachments, and was also tracked alongside the similar **Predator Pain** family. Victims included industrial, engineering, manufacturing, government, higher education, retail, telecommunications, and professional services organizations, with especially heavy targeting reported in the United States, Australia, Canada, parts of Asia, and the Middle East. The malware acted as a feature-rich spyware and keylogger, stealing browser, email, messaging, and FTP credentials, capturing keystrokes, screenshots, clipboard data, and system information, and in some cases injecting into legitimate `.NET` binaries such as `RegAsm.exe` and `vbc.exe`. Investigators said stolen data was exfiltrated through SMTP email, HTTP, PHP web panels, and FTP, including periodic submissions to attacker-controlled mailboxes; one variant checked external connectivity and included the victim’s public IP address in exfiltration messages. Kaspersky also tied Hawkeye-based tooling to **Operation Ghoul**, a financially motivated spear-phishing operation that hit more than 130 organizations and used both malware delivery and phishing pages to harvest accounts.
Aug 15, 2026
Check Point Research reported on **The Eye on the Nile**, an espionage campaign targeting organizations in the Middle East, with activity linked to surveillance and intelligence collection against regional victims. The operation was presented as a coordinated intrusion set focused on harvesting sensitive information from selected targets rather than causing disruptive or destructive effects. The report described a threat actor using tailored malware and targeted delivery methods to compromise victims and maintain access for data collection. The campaign highlighted the continued use of regionally focused cyber-espionage operations against government and other strategic entities, underscoring the risk posed by persistent actors seeking long-term visibility into victim networks and communications.
Jul 12, 2026
Trend Micro and TrendAI reported that **Earth Estries**, a China-linked espionage group active since at least 2020, compromised more than 20 organizations across the United States, Asia-Pacific, the Middle East, South Africa, and Southeast Asia. The intrusions primarily targeted **government, telecommunications, and technology-sector organizations**, with researchers linking the activity to prolonged campaigns against telecom providers and government networks. The group has been associated with overlaps in tradecraft and tooling seen in **FamousSparrow** and other Chinese APT activity, though researchers said some malware and infrastructure may reflect shared ecosystem resources rather than exclusive ownership. Researchers said Earth Estries gained initial access by exploiting public-facing systems, including **Ivanti Connect Secure**, **Fortinet FortiClient EMS** SQL injection flaws, **Sophos Firewall** code injection bugs, and the **Microsoft Exchange ProxyLogon** chain. After breaching servers and administrative accounts, the actors used **PowerShell downgrade attacks**, **DLL sideloading**, **living-off-the-land binaries**, **Cobalt Strike**, **SMB**, and **WMIC** for persistence and lateral movement, while deploying backdoors and implants such as **Zingdoor**, **HemiGate**, **TrillClient**, **GHOSTSPIDER**, **SNAPPYBEE**, **DEMODEX**, and **MASOL RAT**. Stolen documents and browser data were exfiltrated through public file-sharing services and SMTP, and the operators masked command-and-control traffic with techniques including **Fastly CDN** fronting and infrastructure patterns consistent with DNS tunneling.
Aug 21, 2026