Security News > 2022 > September > Russian hackers use new info stealer malware against Ukrainian orgs

Russian hackers have been targeting Ukrainian entities with previously unseen info-stealing malware during a new espionage campaign that is still active.

Security researchers at Cisco Talos attribute the campaign to Gamaredon, a Russian state-backed threat group with a long history of targeting mainly organizations in the Ukrainian government, critical infrastructure, defense, security, and law enforcement.

Cisco Talos attributed a newly observed espionage campaign to Gamaredon and noticed the use of a new info stealer that can extract from victim computers specific file types as well as deploy additional malware.

Cisco Talos says that Gamaredon's new infostealer can exfiltrate files from attached storage devices, making for each stolen file a POST request with metadata and its content.

During the recursive enumeration of all files in directories, the malware avoids system folders to focus only on files of interest to the threat actor.

Cisco Talos has provided a list of indicators of compromise for malicious documents, LNK files, RAR archives, the new infostealer, URLs, and payload drop sites.

News URL

https://www.bleepingcomputer.com/news/security/russian-hackers-use-new-info-stealer-malware-against-ukrainian-orgs/