Security News > 2022 > September > Russian hackers use new info stealer malware against Ukrainian orgs
Russian hackers have been targeting Ukrainian entities with previously unseen info-stealing malware during a new espionage campaign that is still active.
Security researchers at Cisco Talos attribute the campaign to Gamaredon, a Russian state-backed threat group with a long history of targeting mainly organizations in the Ukrainian government, critical infrastructure, defense, security, and law enforcement.
Cisco Talos attributed a newly observed espionage campaign to Gamaredon and noticed the use of a new info stealer that can extract from victim computers specific file types as well as deploy additional malware.
Cisco Talos says that Gamaredon's new infostealer can exfiltrate files from attached storage devices, making for each stolen file a POST request with metadata and its content.
During the recursive enumeration of all files in directories, the malware avoids system folders to focus only on files of interest to the threat actor.
Cisco Talos has provided a list of indicators of compromise for malicious documents, LNK files, RAR archives, the new infostealer, URLs, and payload drop sites.
News URL
Related news
- Russian Espionage Group Targets Ukrainian Military with Malware via Telegram (source)
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails (source)
- Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Russian charged by U.S. for creating RedLine infostealer malware (source)
- Uncle Sam outs a Russian accused of developing Redline infostealing malware (source)
- Russian hackers deliver malicious RDP configuration files to thousands (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)
- Unpatched Mazda Connect bugs let hackers install persistent malware (source)