[ad_1]
A spear-phishing marketing campaign doubtless coordinated by a state-backed risk actor has been concentrating on European authorities personnel offering logistics assist to Ukrainian refugees.
Based on American cybersecurity agency Proofpoint, the attackers use “presumably compromised” electronic mail accounts of Ukrainian armed service members to ship the phishing message.
The researchers mentioned the phishing assaults they noticed had been concentrating on solely European governmental entities and added that, for now, they could not attribute the assaults to a selected state-sponsored hacking group.
“Proofpoint has recognized a probable nation-state sponsored phishing marketing campaign utilizing a presumably compromised Ukrainian armed service member’s electronic mail account to focus on European authorities personnel concerned in managing the logistics of refugees fleeing Ukraine,” Proofpoint researchers mentioned.
“The e-mail included a malicious macro attachment which tried to obtain a Lua-based malware dubbed SunSeed,” a malware downloader that can be utilized to ship second-stage payloads to compromised gadgets.
Nevertheless, primarily based on the an infection chain, the researchers mentioned the marketing campaign tracked as Asylum Ambuscade aligns and is probably going associated to July 2021 phishing assaults linked to the Ghostwriter Belarusian risk group (additionally tracked as TA445 or UNC1151).
Ghostwriter was linked with excessive confidence in November 2021 by Mandiant safety researchers to the Belarusian authorities.
Since Russia invaded Ukraine seven days in the past, this risk group has already been linked to different assaults in opposition to Ukrainians.
As an illustration, the Pc Emergency Response Crew of Ukraine (CERT-UA) warned of Ghostwriter operators making an attempt to compromise the personal electronic mail accounts of Ukrainian navy personnel and “associated people” to ship phishing to their contacts.
On Monday, Fb additionally took down accounts used by Ghostwriter to focus on the accounts of Ukrainian officers and navy personnel on its platform. It additionally added that it blocked phishing domains used to try to compromise the accounts of Ukrainian customers.
“This exercise, unbiased of attribution conclusions, represents an effort to focus on NATO entities with compromised Ukrainian navy accounts throughout an lively interval of armed battle between Russia, its proxies, and Ukraine,” the Proofpoint researchers concluded.
“Moreover, the potential of exploiting intelligence round refugee actions in Europe for disinformation functions is a confirmed a part of Russian and Belarussian-state methods.”
[ad_2]
