Charities, non-governmental organizations (NGOs), and other aid organizations providing support in Ukraine amid Russia’s invasion of the country have been targeted by a malicious campaign in order to spread confusion and cause disruption, Amazon says.
“In these particularly egregious cases, malware has been targeted at disrupting medical supplies, food, and clothing relief,” the company said without disclosing additional details regarding the malware used in the attacks or what organizations were targeted.
“While we are seeing an increase in activity of malicious state actors, we are also seeing a higher operational tempo by other malicious actors,” Amazon said.
“Unlike other U.S. technology providers, AWS has no data centers, infrastructure, or offices in Russia, and we have a long-standing policy of not doing business with the Russian government,” the company added.
Last week, Proofpoint researchers shared details on a similar malicious campaign aimed at European organizations assisting the efforts to aid Ukrainian refugees fleeing the country.
Dubbed ‘Asylum Ambuscade,’ the campaign bears some similarities to attacks linked to Ghostwriter (UNC1151), a hacker group believed to be working on behalf of the Belarusian government. The campaign exploited an email address, which appears to belong to a compromised Ukrainian armed service member, to infect victims with the SunSeed malware, a downloader intended for delivering additional malicious payloads.
Cybersecurity Help’s statement on the critical situation in Ukraine
On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war!