Threat actors target Ukrainian government agencies in new wave of SmokeLoader attacks
CERT-UA published Indicators of Compromise related to a new malicious campaign by a financially motivated threat actor tracked as UAC-0006 targeting government entities in Ukraine. The team said that between 2-6 October 2023 the attackers launched at least four waves of attacks.
The SmokeLoader malware is delivered via phishing emails in the form of a ZIP archive or a PDF document. The malware’s command-and-control server is hosted in Russia, according to CERT-UA.
The cyber defenders believe that the goal of this campaign is to steal login credentials such as logins, passwords and certificate keys from accounting software used by government agencies and/or modify banking details in financial documents in remote banking systems to steal money.
CERT-UA notes that between August and September 2023, UAC-0006 attempted to steal millions of hryvnias from organizations. The team didn’t say if any of these attempts were successful.
Latest Posts
Microsoft fixes over 60 bugs, two zero-days
One of the zero-days was linked to the QakBot botnetю
Threat actors using DNS tunneling for scanning and tracking
The campaigns showcase how malicious actors evolve their tactics to bypass traditional network security measures.
INC ransomware source code reportedly on sale for $300,000
The announcement of the sale includes both the Windows and Linux/ESXi versions of INC.