arXiv subjects

Alessio Di Santo

Publications and source records attributed to Alessio Di Santo.

5 recordsLinked to original sources

arXiv2025

Linguistic Predictability and Search Complexity: How Linguistic Redundancy Constraints the Landscape of Classical and Quantum Search

This study examines the quantitative relationship between linguistic regularities and computational search complexity through a hybrid classical-quantum framework applied to Renaissance Italian texts. Using four representative works from the fifteenth and sixteenth centuries-Il Principe (Machiavelli), Il Cortegiano (Castiglione), I Ricordi (Guicciardini), and Orlando Furioso (Ariosto)-we construct character-based n-gram models under both a historically grounded 25-letter orthography and the full modern Italian alphabet. These models provide corpus-derived probabilistic baselines for evaluating substitution-cipher search processes. Combining classical hill climbing and simulated annealing with Grover-style quantum-inspired estimates and a QUBO annealing formulation, we quantify how the probability that a key produces a linguistically plausible decryption (pgood) relates to expected computational effort. Across cipher lengths from 200 to 1000 characters, empirical results confirm the predicted dependence of Grover oracle calls on 1/sqrt(pgood) and show that longer texts yield sharper score distributions and smaller feasible key regions. Overall, the findings establish a link between linguistic redundancy and search-space contraction, providing an empirical framework for comparing classical, quantum-inspired, and idealized quantum search dynamics under unified corpus-driven constraints.

quant-ph↗

arXiv2025

Lazarus Group Targets Crypto-Wallets and Financial Data while employing new Tradecrafts

This report presents a comprehensive analysis of a malicious software sample, detailing its architecture, behavioral characteristics, and underlying intent. Through static and dynamic examination, the malware core functionalities, including persistence mechanisms, command-and-control communication, and data exfiltration routines, are identified and its supporting infrastructure is mapped. By correlating observed indicators of compromise with known techniques, tactics, and procedures, this analysis situates the sample within the broader context of contemporary threat campaigns and infers the capabilities and motivations of its likely threat actor. Building on these findings, actionable threat intelligence is provided to support proactive defenses. Threat hunting teams receive precise detection hypotheses for uncovering latent adversarial presence, while monitoring systems can refine alert logic to detect anomalous activity in real time. Finally, the report discusses how this structured intelligence enhances predictive risk assessments, informs vulnerability prioritization, and strengthens organizational resilience against advanced persistent threats. By integrating detailed technical insights with strategic threat landscape mapping, this malware analysis report not only reconstructs past adversary actions but also establishes a robust foundation for anticipating and mitigating future attacks.

cs.CR↗

arXiv2025

Plug. Play. Persist. Inside a Ready-to-Go Havoc C2 Infrastructure

This analysis focuses on a single Azure-hosted Virtual Machine at 52.230.23.114 that the adversary converted into an all-in-one delivery, staging and Command-and-Control node. The host advertises an out-of-date Apache 2.4.52 instance whose open directory exposes phishing lures, PowerShell loaders, Reflective Shell-Code, compiled Havoc Demon implants and a toolbox of lateral-movement binaries; the same server also answers on 8443/80 for encrypted beacon traffic. The web tier is riddled with publicly documented critical vulnerabilities, that would have allowed initial code-execution had the attackers not already owned the device. Initial access is delivered through an HTML file that, once de-obfuscated, perfectly mimics Google Unusual sign-in attempt notification and funnels victims toward credential collection. A PowerShell command follows: it disables AMSI in-memory, downloads a Base64-encoded stub, allocates RWX pages and starts the shell-code without ever touching disk. That stub reconstructs a DLL in memory using the Reflective-Loader technique and hands control to Havoc Demon implant. Every Demon variant-32- and 64-bit alike-talks to the same backend, resolves Windows APIs with hashed look-ups, and hides its activity behind indirect syscalls. Runtime telemetry shows interests in registry under Image File Execution Options, deliberate queries to Software Restriction Policy keys, and heavy use of Crypto DLLs to protect payloads and C2 traffic. The attacker toolkit further contains Chisel, PsExec, Doppelganger and Whisker, some of them re-compiled under user directories that leak the developer personas tonzking123 and thobt. Collectively the findings paint a picture of a technically adept actor who values rapid re-tooling over deep operational security, leaning on Havoc modularity and on legitimate cloud services to blend malicious flows into ordinary enterprise traffic.

cs.CR↗

arXiv2025

Under the Hood of BlotchyQuasar: DLL-Based RAT Campaigns Against Latin America

A sophisticated malspam campaign was recently uncovered targeting Latin American countries, with a particular focus on Brazil. This operation utilizes a highly deceptive phishing email to trick users into executing a malicious MSI file, initiating a multi-stage infection. The core of the attack leverages DLL side-loading, where a legitimate executable from Valve Corporation is used to load a trojanized DLL, thereby bypassing standard security defenses. Once active, the malware, a variant of QuasarRAT known as BlotchyQuasar, is capable of a wide range of malicious activities. It is designed to steal sensitive browser-stored credentials and banking information, the latter through fake login windows mimicking well-known Brazilian banks. The threat establishes persistence by modifying the Windows registry , captures user keystrokes through keylogging , and exfiltrates stolen data to a Command-and-Control (C2) server using encrypted payloads. Despite its advanced capabilities, the malware code exhibits signs of rushed development, with inefficiencies and poor error handling that suggest the threat actors prioritized rapid deployment over meticulous design. Nonetheless, the campaign extensive reach and sophisticated mechanisms pose a serious and immediate threat to the targeted regions, underscoring the need for robust cybersecurity defenses.

cs.CR↗

arXiv2024

Security and Fairness in Multi-Party Quantum Secret Sharing Protocol

Quantum secret sharing (QSS) is a cryptographic protocol that leverages quantum mechanics to distribute a secret among multiple parties. With respect to the classical counterpart, in QSS the secret is encoded into quantum states and shared by a dealer such that only an authorized subsets of participants, i.e., the players, can reconstruct it. Several state-of-the-art studies aim to transpose classical Secret Sharing into the quantum realm, while maintaining their reliance on traditional network topologies (e.g., star, ring, fully-connected) and require that all the n players calculate the secret. These studies exploit the Greenberger-Horne-Zeilinger (GHZ) state, which is a type of maximally entangled quantum state involving three or more qubits. However, none of these works account for redundancy, enhanced security/privacy features or authentication mechanisms able to fingerprint players. To address these gaps, in this paper we introduce a new concept of QSS which leans on a generic distributed quantum-network, based on a threshold scheme, where all the players collaborate also to the routing of quantum information among them. The dealer, by exploiting a custom flexible weighting system, takes advantage of a newly defined quantum Dijkstra algorithm to select the most suitable subset of t players, out of the entire set on n players, to involve in the computation. To fingerprint and authenticate users, CRYSTAL-Kyber primitives are adopted, while also protecting each player's privacy by hiding their identities. We show the effectiveness and performance of the proposed protocol by testing it against the main classical and quantum attacks, thereby improving the state-of-the-art security measures.

quant-ph↗