Russian hackers use fake “Windows update” to attack government targets
Ukrainian government staff targeted with fake Windows updates
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Russian cybercriminals have been observed targeting Ukrainian government employees with information-stealingmalwareby posing as IT staff working in these institutions.
Cybersecurity researchers from the Computer Emergency Response Team of Ukraine (CERT-UA) spotted the hacking campaign in which Russian state-sponsored hackers from the APT28 threat actor (also known as Fancy Bear) were sending emails to Ukraine government employees.
These emails claimed to be from the government’s IT department, and urged them to update their Windows devices immediately in order to prevent possible cyberattacks.
Posing as Ukrainians
The researchers could not say how the attackers obtained this information, but to improve their credibility, the hackers would create @outlook.com email addresses, using the names of real people working in these organizations.
If any victims took the bait, the attackers would advise them to run a PowerShell command which, instead of updating the device, downloaded an information-stealing malware.
This malware abuses the “tasklist” and “systeminfo” commands to harvest sensitive data and send them to a Mocky service API via an HTTP request.
These are the best firewalls right now>Russia’s quest to seize control of the internet in Ukraine>Ukraine wants Russia kicked off the internet
To make sure no one falls for the trick, CERT-UA recommends actual IT departments restrict the ability to run PowerShell commands on critical devices and monitor network traffic for suspicious activity, especially if something’s connecting to the Mocky service API.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The Russo-Ukrainian war that’s been raging for more than a year now is being fought on two fronts - one physical, and one in cyberspace. Russian hackers have been hard at work, trying to infect government endpoints with malware, as well as trying to bring down key government and media websites.
In fact, almost two-thirds (60%) of all phishing emails that targeted Ukrainian targets in the first quarter of the year came from Russian threat actors,Google’s Threat Analysis Group (TAG) says. TAG also claims APT28 is one of the key players in this campaign.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
New fanless cooling technology enhances energy efficiency for AI workloads by achieving a 90% reduction in cooling power consumption
