Milan

Milan is a malicious software, or malware, that was notably deployed by the cyber group OilRig in 2021. The group updated its DanBot backdoor and began deploying multiple backdoors including Shark, Milan, and Marlin. These backdoors were mentioned in the T3 2021 issue of the ESET Threat Report. Similarities were observed between the Solar backdoor and the backdoors used in Out to Sea, particularly with respect to upload and download schemes. Both Solar and Shark, another OilRig backdoor, along with Milan, use URIs with simple upload ("u") and download ("d") schemes to communicate with the Command & Control server. In 2022, Milan suffered from an extensive number of Distributed Denial of Service (DDoS) attacks, receiving the most such attacks in Italy. Over 5,000 DDoS attacks were reported, disrupting operations and causing significant downtime. This has highlighted the importance of having physical locations for Security Operations Centers (SOCs), as stressed by Milan Patel, BlueVoyant’s global head of managed detection and response (MDR). The impact of the Milan malware extended to various sectors, including the restaurant industry. A worker at a Milan restaurant reported that their system was offline for several hours due to a suspected attack, requiring technical assistance to restore operations. Following the outage, some McDonald’s restaurants, including those in Bangkok and Milan, were able to resume normal operations. These incidents underscore the pervasive threat posed by malware like Milan and the need for robust cybersecurity measures across industries.