Security News > 2022 > March > Hackers Try to Target European Officials to Get Info on Ukrainian Refugees, Supplies

Details of a new nation-state sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what's seen as an attempt to obtain intelligence on refugee and supply movement in the region.

Enterprise security company Proofpoint, which detected the malicious emails for the first time on February 24, 2022, dubbed the social engineering attacks "Asylum Ambuscade."

"The email also contained a malicious attachment which attempted to download malicious Lua malware named SunSeed and targeted European government personnel tasked with managing transportation and population movement in Europe."

One of the notable aspects of Asylum Ambuscade is the likely use of a compromised Ukrainian armed service member's email account to broadcast malware-laced email messages containing a macro-enabled XLS file that delivers SunSeed onto infected hosts, implying that the latest campaign may be a continuation of these attacks.

What's more, email security company Avanan said it witnessed an eightfold increase in email-borne attacks originating from Russia starting on February 27, at least some of them targeting manufacturing, international shipping, and transportation companies located in the U.S. and Europe.

"In light of the ongoing Russia-Ukraine war, actions by proxy actors like TA445 will continue to target European governments to gather intelligence around the movement of refugees from Ukraine and on issues of importance to the Russian government," the researchers said.

News URL

https://thehackernews.com/2022/03/hackers-try-to-hack-european-officials.html