22 June 2022

Ukraine’s cybersecurity authorities warn of two new malicious campaigns


Ukraine’s cybersecurity authorities warn of two new malicious campaigns

The Computer Emergency Response Team of Ukraine (CERT-UA) has detailed two new hacking campaigns, one of them aimed at the country’s critical infrastructure sector.

The first campaign involved phishing emails distributing a malicious Microsoft Word document titled “Imposition of penalties” ostensibly sent from the State Tax Service of Ukraine. Once the document is opened, the download of an HTML file is triggered, which, in turn, leads to the execution of the JavaScript code that exploits the Follina (CVE-2022-30190) vulnerability on the victim's system to download the Cobalt Strike Beacon malware.

CVE-2022-30190 is the Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution bug, which allows a remote hacker to execute arbitrary shell commands on the target system. The vulnerability was fixed earlier this month as part of Microsoft’s June 2022 Patch Tuesday release.

According to cybersecurity officials, the campaign targeted unspecified critical infrastructure within Ukraine. CERT-UA attributed this campaign to a threat actor it tracks as UAC-0098, which previously has been linked to other attacks against Ukraine.

In the second campaign attackers distributed a malicious Microsoft Word document titled “Nuclear Terrorism A Very Real Threat.rtf,” which also exploited the CVE-2022-30190 vulnerability to install the CredoMap malware.

The CERT-UA team associated the new campaign with the APT28 (aka Fancy Bear) advanced persistent threat group thought to be a Russian military unit specializing on cyber-espionage.

Earlier, German authorities issued an arrest warrant for the Russian hacker Nikolaj Kozachek (aka “blabla1234565” and “kazak”) linked to APT28 who was accused of carrying out cyber-espionage operations against a NATO think tank in Germany.

Cybersecurity Help statement on the critical situation in Ukraine

On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war! Слава Україні!

Back to the list

Latest Posts

Cyber Security Week In Review: December 1, 2023

Cyber Security Week In Review: December 1, 2023

The world in brief: Apple, Google fix WebKit, Chrome zero-days, Qlik Sense bugs exploited by Cactus ransomware, and more.
1 December 2023
New GoTitan botnet exploits recently patched Apache ActiveMQ flaw

New GoTitan botnet exploits recently patched Apache ActiveMQ flaw

GoTitan is designed for launching DDoS attacks via protocols such as HTTP, UDP, TCP, and TLS.
30 November 2023
US sanctions Sindbad crypto mixer allegedly used by North Korea’s Lazarus hackers

US sanctions Sindbad crypto mixer allegedly used by North Korea’s Lazarus hackers

The authorities described the service as “a key money-laundering tool” of Lazarus.
30 November 2023