Article Details
Scrape Timestamp (UTC): 2024-08-21 05:31:00.242
Source: https://thehackernews.com/2024/08/cert-ua-warns-of-new-vermin-linked.html
Original Article Text
Click to Toggle View
CERT-UA Warns of New Vermin-Linked Phishing Attacks with PoW Bait. The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of new phishing attacks that aim to infect devices with malware. The activity has been attributed to a threat cluster it tracks as UAC-0020, which is also known as Vermin. The exact scale and scope of the attacks are presently unknown. The attack chains commence with phishing messages with photos of alleged prisoners of war (PoWs) from the Kursk region, urging recipients to click on a link pointing to a ZIP archive. The ZIP file contains a Microsoft Compiled HTML Help (CHM) file that embeds JavaScript code responsible for launching an obfuscated PowerShell script. "Opening the file installs components of known spyware SPECTR, as well as the new malware called FIRMACHAGENT," CERT-UA said. "The purpose of FIRMACHAGENT is to retrive the data stolen by SPECTR and send it to a remote management server." SPECTR is a known malware linked to Vermin as far back as 2019. The group is assessed to be linked to security agencies of the Luhansk People's Republic (LPR). Earlier this June, CERT-UA detailed another campaign orchestrated by the Vermin actors called SickSync that targeted defense forces in the country with SPECTR. SPECTR is a fully-featured tool designed to harvest a wide range of information, including files, screenshots, credentials, and data from various instant messaging apps like Element, Signal, Skype, and Telegram.
Daily Brief Summary
The Computer Emergency Response Team of Ukraine (CERT-UA) has alerted to a new series of phishing attacks aimed at distributing malware.
The attacks are connected with a threat group tracked as UAC-0020, also referred to as Vermin, linked to Luhansk People's Republic's security agencies.
Phishing emails entice recipients to download a ZIP file by showcasing images supposedly of prisoners of war from Kursk, which contains malicious software.
The malicious ZIP file carries a Microsoft Compiled HTML Help (CHM) file embedding a JavaScript which triggers an obfuscated PowerShell script.
When the CHM file is opened, it installs the SPECTR spyware and a new malware, FIRMACHAGENT, designed to retrieve and transmit stolen data to a remote server.
SPECTR spyware, known since 2019, can gather extensive data, including files, screenshots, credentials, and information from various communication platforms like Skype and Telegram.
Earlier campaigns by these actors targeted Ukrainian defense forces using similar tools and methods.