Phishing, Malware and Hacker Teams Taking Sides

Ukraine’s Pc Emergency Response Staff (CERT-UA) has warned of Belarusian state-sponsored hackers focusing on its army personnel and associated people as a part of a phishing marketing campaign mounted amidst Russia’s army invasion of the nation.

“Mass phishing emails have just lately been noticed focusing on non-public ‘i.ua’ and ‘meta.ua’ accounts of Ukrainian army personnel and associated people,” the CERT-UA mentioned. “After the account is compromised, the attackers, by the IMAP protocol, get entry to all of the messages.”

Subsequently, the assaults leverage the contact data saved within the sufferer’s tackle ebook to propagate the phishing messages to different targets.

The Ukrainian authorities attributed the actions to a menace actor tracked as UNC1151, a Minsk-based group whose “members are officers of the Ministry of Defence of the Republic of Belarus.” In a follow-up replace, the company mentioned the nation-state group additionally targets its personal residents, whereas concurrently setting its sights on Russian entities –

• Affiliation of Belarusians of the World (Worldwide Social Union)
• Belarusian Music Pageant
• Samara Oblasna Public Group “Russian-Belarusian Fraternity 2000”
• Dzêâslov, a Belarusian literary journal
• Soviet Belarus (Sovetskaya Belorussiya), a every day newspaper in Belarus
• Staff of the Nationwide Academy of the Republic of Kazakhstan, and
• Voice of the Motherland, a neighborhood newspaper in Belarus

UNC1151 is the Mandiant-assigned moniker to an uncategorized menace cluster, which operates with goals which are aligned with Belarusian authorities pursuits. The hacking group is believed to have been lively since no less than 2016.

“UNC1151 has focused all kinds of governmental and personal sector entities, with a spotlight in Ukraine, Lithuania, Latvia, Poland, and Germany,” Mandiant researchers mentioned in a November 2021 report. “The focusing on additionally contains Belarusian dissidents, media entities, and journalists.”

The state-backed cyber espionage group has additionally been linked to the Ghostwriter disinformation marketing campaign that promulgated anti-NATO and corruption-themed narratives geared toward Lithuania, Latvia, and Poland with the possible aim of undermining the governments and creating tensions within the area.

What’s extra, the January defacement assaults of a number of Ukrainian authorities web sites with threatening messages is believed to be the handiwork of UNC1151 as nicely.

Hacking Teams Take Sides

The event follows a barrage of knowledge wiper and distributed-denial-of-service (DDoS) assaults towards Ukrainian authorities businesses, at the same time as numerous hacking teams and ransomware syndicates are capitalizing on the chaos to take sides and additional their actions.

“The Nameless collective is formally in cyber struggle towards the Russian authorities,” the decentralized hacktivist group tweeted, including it “leaked the database of the Russian Ministry of Protection web site.”

One other group that has declared its fealty to Ukraine is the vigilante group often known as GhostSec (quick for Ghost Safety), which introduced it had flooded Russian army web sites with DDoS assaults “in help of the folks in Ukraine.”

The Conti ransomware cartel, which just lately absorbed the now-shuttered TrickBot trojan, rallied its “full help” behind the Russian authorities, threatening to “strike again on the important infrastructures of an enemy” ought to “anyone will resolve to arrange a cyber assault or any struggle actions towards Russia.”

The group, nevertheless, later rephrased its assertion to state that “we don’t ally with any authorities and we condemn the continued struggle.” However the Conti workforce additionally maintained that it “will use our full capability to ship retaliatory measures in case the Western warmongers try to focus on important infrastructure in Russia or any Russian-speaking area of the world.”

Different hacking entities to declare allegiance to Russia are the RedBanditsRU cybercrime group and the lesser-known CoomingProject ransomware program, which pledged to “assist the Russian authorities if cyber assaults and conduct towards Russia.”