Article Details
Scrape Timestamp (UTC): 2024-08-13 05:13:53.352
Source: https://thehackernews.com/2024/08/ukraine-warns-of-new-phishing-campaign.html
Original Article Text
Click to Toggle View
Ukraine Warns of New Phishing Campaign Targeting Government Computers. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign that masquerades as the Security Service of Ukraine to distribute malware capable of remote desktop access. The agency is tracking the activity under the name UAC-0198. More than 100 computers are estimated to have been infected since July 2024, including those related to government bodies in the country. The attack chains involve the mass distribution of emails to deliver a ZIP archive file containing an MSI installer file, the opening of which leads to the deployment of malware called ANONVNC. ANONVNC, which is based on an open-source remote management tool called MeshAgent, allows for stealthy unauthorized access to the infected hosts. The development comes as CERT-UA attributed the hacking group UAC-0102 to phishing attacks propagating HTML attachments that mimic the login page of UKR.NET to steal users' credentials. Over the past few weeks, the agency has also warned of a surge in campaigns distributing the PicassoLoader malware with the end goal of deploying Cobalt Strike Beacon on compromised systems. The attacks have been linked to a threat actor tracked as UAC-0057. "It is reasonable to assume that the objects of interest of UAC-0057 could be both specialists of project offices and their 'contractors' from among the employees of the relevant local governments of Ukraine," CERT-UA said.
Daily Brief Summary
Ukraine's CERT-UA has issued a warning about a new phishing campaign using emails purporting to be from the Security Service to install malware on government computers.
The malware, named ANONVNC, allows attackers stealthy access and is based on the open-source remote tool MeshAgent.
The campaign has already impacted over 100 computers since July 2024, specifically targeting Ukrainian government entities.
The phishing emails distribute a ZIP archive containing an MSI installer, triggering the malware deployment upon opening.
CERT-UA also highlighted recent phishing scams by UAC-0102 using HTML attachments to steal credentials from users of UKR.NET.
Additionally, there has been an increase in the distribution of PicassoLoader malware aimed at deploying Cobalt Strike Beacon in compromised systems.
The activities are connected to a threat actor identified as UAC-0057, focusing on government project offices and local government contractors in Ukraine.