Ukrainian officers, navy focused by Ghostwriter hackers

Fb (now often known as Meta) says it took down accounts used by a Belarusian-linked hacking group (UNC1151 or Ghostwriter) to focus on Ukrainian officers and navy personnel on its platform.

In November 2021, Mandiant safety researchers linked the UNC1151 menace group with excessive confidence to the Belarusian authorities, in addition to a hacking operation the corporate tracks as Ghostwriter.

Fb additionally blocked a number of phishing domains utilized by the menace actors to attempt to compromise the accounts of Ukrainian customers.

“We detected makes an attempt to focus on individuals on Fb to put up YouTube movies portraying Ukrainian troops as weak and surrendering to Russia, together with one video claiming to indicate Ukrainian troopers popping out of a forest whereas flying a white flag of give up,” Meta’s Head of Safety Coverage Nathaniel Gleicher and Menace Disruption Director David Agranovich stated.

“We additionally blocked phishing domains these hackers used to attempt to trick individuals in Ukraine into compromising their on-line accounts.”

Accounts believed to be focused on this marketing campaign have been secured by Fb’s safety staff, and the customers have been alerted of the hacking makes an attempt.  

Fb additionally took down a small community of some dozen Fb and Instagram Pages and Teams working from Russia and Ukraine and concentrating on Ukrainians through faux accounts throughout a number of social media platforms, together with Fb, Instagram, Twitter, YouTube, Telegram, Odnoklassniki, and VK.

This operation was additionally behind a small variety of websites that have been masquerading as unbiased information portals and publishing claims about Ukraine being betrayed by the West and “being a failed state.”

Hybrid warfare

Meta’s report confirms a warning issued by the Pc Emergency Response Staff of Ukraine (CERT-UA) on Friday concerning spearphishing assaults concentrating on the personal e-mail accounts of the Ukrainian navy.

Electronic mail accounts compromised in these assaults have been then used to focus on the victims’ contacts with related phishing messages threatening to completely disable their accounts except they verified their contact info.

The Ukrainian State Service of Particular Communications and Data Safety (SSSCIP) additionally warned of a separate and ongoing collection of phishing assaults concentrating on Ukrainians with malicious paperwork.

Slovak web safety agency ESET issued its personal alert the identical day concerning cybercriminals impersonating humanitarian organizations to rip-off donors of organizations centered on serving to Ukraine throughout the conflict began Thursday by Russia’s invasion.

These assaults comply with data-wiping assaults towards Ukrainian networks with HermeticWiper malware and ransomware decoys aiming to destroy knowledge and render gadgets unbootable. In January, Ukraine was additionally hit by knowledge wipers when the WhisperGate wiper was deployed in assaults disguised as ransomware.

Earlier than Russia’s invasion, the Ukrainian Safety Service (SSU) stated the nation is being focused by a “huge wave of hybrid warfare.”

Over the weekend, Ukraine’s Vice Prime Minister Mykhailo Fedorov introduced the creation of an “IT military” to assist Ukraine “combat on the cyber entrance.”