22 June 2022

Ukraine’s cybersecurity authorities warn of two new malicious campaigns


Ukraine’s cybersecurity authorities warn of two new malicious campaigns

The Computer Emergency Response Team of Ukraine (CERT-UA) has detailed two new hacking campaigns, one of them aimed at the country’s critical infrastructure sector.

The first campaign involved phishing emails distributing a malicious Microsoft Word document titled “Imposition of penalties” ostensibly sent from the State Tax Service of Ukraine. Once the document is opened, the download of an HTML file is triggered, which, in turn, leads to the execution of the JavaScript code that exploits the Follina (CVE-2022-30190) vulnerability on the victim's system to download the Cobalt Strike Beacon malware.

CVE-2022-30190 is the Microsoft Windows Support Diagnostic Tool (MSDT) remote code execution bug, which allows a remote hacker to execute arbitrary shell commands on the target system. The vulnerability was fixed earlier this month as part of Microsoft’s June 2022 Patch Tuesday release.

According to cybersecurity officials, the campaign targeted unspecified critical infrastructure within Ukraine. CERT-UA attributed this campaign to a threat actor it tracks as UAC-0098, which previously has been linked to other attacks against Ukraine.

In the second campaign attackers distributed a malicious Microsoft Word document titled “Nuclear Terrorism A Very Real Threat.rtf,” which also exploited the CVE-2022-30190 vulnerability to install the CredoMap malware.

The CERT-UA team associated the new campaign with the APT28 (aka Fancy Bear) advanced persistent threat group thought to be a Russian military unit specializing on cyber-espionage.

Earlier, German authorities issued an arrest warrant for the Russian hacker Nikolaj Kozachek (aka “blabla1234565” and “kazak”) linked to APT28 who was accused of carrying out cyber-espionage operations against a NATO think tank in Germany.

Cybersecurity Help statement on the critical situation in Ukraine

On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war! Слава Україні!

Back to the list

Latest Posts

Researchers uncovered undetectable malware linked to Russia's APT

Researchers uncovered undetectable malware linked to Russia's APT

According to a recent report published by Palo Alto Networks, new piece of malware currently evades 56 antivirus products.  
6 July 2022
New ransomware operation RedAlert puts victims on a "board of shame"

New ransomware operation RedAlert puts victims on a "board of shame"

At this point, only one victim is listed on the RedAlert’s data leak website, indicating that the development is very new.
6 July 2022
Microsoft silently issued a fix for ‘ShadowCoerce’ NTLM Relay attack

Microsoft silently issued a fix for ‘ShadowCoerce’ NTLM Relay attack

Despite patching the flaw, Microsoft hasn’t provided any details about it and assigned a CVE ID yet.
6 July 2022