Security News > 2022 > September > Russian Gamaredon Hackers Target Ukrainian Government Using Info-Stealing Malware
An ongoing espionage campaign operated by the Russia-linked Gamaredon group is targeting employees of Ukrainian government, defense, and law enforcement agencies with a piece of custom-made information stealing malware.
"The adversary is using phishing documents containing lures related to the Russian invasion of Ukraine," Cisco Talos researchers Asheer Malhotra and Guilherme Venere said in a technical write-up shared with The Hacker News.
Active since 2013, Gamaredon - also known as Actinium, Armageddon, Primitive Bear, Shuckworm, and Trident Ursa - has been linked to numerous attacks aimed at Ukrainian entities in the aftermath of Russia's military invasion of Ukraine in late February 2022.
The LNK files seemingly reference intelligence briefings related to the Russian invasion of Ukraine to trick unsuspecting victims into opening the shortcuts, resulting in the execution of a PowerShell beacon script that ultimately paves the way for next-stage payloads.
This includes another PowerShell script that's used to provide persistent access to compromised system and deliver additional malware, including a new malware capable of plundering files from the machine as well as any removable drive connected to it.
"The infostealer is a dual-purpose malware that includes capabilities for exfiltrating specific file types and deploying additional binary and script-based payloads on an infected endpoint," the researchers said, adding it may be a component of the Giddome backdoor family.
News URL
https://thehackernews.com/2022/09/russian-gamaredon-hackers-target.html
Related news
- Russian Espionage Group Targets Ukrainian Military with Malware via Telegram (source)
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails (source)
- Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Russian charged by U.S. for creating RedLine infostealer malware (source)
- Uncle Sam outs a Russian accused of developing Redline infostealing malware (source)
- Russian hackers deliver malicious RDP configuration files to thousands (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)
- Unpatched Mazda Connect bugs let hackers install persistent malware (source)