[ad_1]
The Russia-linked Gamaredon hacking group tried to compromise an unnamed Western authorities entity working in Ukraine final month amidst ongoing geopolitical tensions between the 2 international locations.
Palo Alto Networks’ Unit 42 menace intelligence workforce, in a new report publicized on February 3, stated that the phishing assault happened on January 19, including it “mapped out three giant clusters of their infrastructure used to assist completely different phishing and malware functions.”
The menace actor, also referred to as Shuckworm, Armageddon, or Primitive Bear, has traditionally centered its offensive cyber assaults towards Ukrainian authorities officers and organizations since 2013. Final 12 months, Ukraine disclosed the collective’s ties to Russia’s Federal Safety Service (FSB).
To hold out the phishing assault, the operators behind the marketing campaign leveraged a job search and employment platform inside the nation as a conduit to add their malware downloader within the type of a resume for an energetic job itemizing associated to the focused entity.
“Given the steps and precision supply concerned on this marketing campaign, it seems this may occasionally have been a selected, deliberate try by Gamaredon to compromise this Western authorities group,” the researchers famous.
Moreover, Unit 42 uncovered proof of a Gamaredon marketing campaign concentrating on the State Migration Service (SMS) of Ukraine on December 1, 2021, which used a Phrase doc as a lure to put in the open-source UltraVNC digital community computing (VNC) software program for sustaining distant entry to contaminated computer systems.
“Gamaredon actors pursue an attention-grabbing strategy in relation to constructing and sustaining their infrastructure,” researchers stated. “Most actors select to discard domains after their use in a cyber marketing campaign with a view to distance themselves from any attainable attribution. Nevertheless, Gamaredon’s strategy is exclusive in that they seem to recycle their domains by constantly rotating them throughout new infrastructure.”
Taken collectively, the assault infrastructure spans throughout no fewer than 700 rogue domains, 215 IP addresses, and over 100 samples of malware, with the clusters used to host weaponized paperwork which can be engineered to execute malicious code when opened and function command-and-control servers for its Pterodo (aka Pteranodon) distant entry trojan.
The findings arrive lower than per week after Broadcom-owned Symantec revealed particulars of one other assault orchestrated by the identical group between July and August 2021 concentrating on an unidentified Ukrainian group to deploy the Pterodo RAT for post-exploitation actions.
[ad_2]
