Security News > 2023 > February > Ukraine says Russian hackers backdoored govt websites in 2021
The Computer Emergency Response Team of Ukraine says Russian state hackers have breached multiple government websites this week using backdoors planted as far back as December 2021.
CERT-UA spotted the attacks after discovering a web shell on Thursday morning on one of the hacked websites that the threat actors used to install additional malware.
"Today, on February 23, an attack was detected on a number of websites of Ukrainian central and local authorities, resulting in a modification of the content of some of their webpages," Ukraine's cybersecurity defense and security agency SSSCIP said on Thursday.
Ember Bear, the group behind this week's incident, has been active since at least March 2021 and is focused on targeting Ukrainian entities with backdoors, information stealers, and fake ransomware primarily delivered via phishing emails.
The APT group was spotted ramping up its phishing campaigns and network compromise efforts in Ukraine starting in December 2021.
Last month, CERT-UA disclosed another cyberattack linked to the Russian Sandworm military hacking group against the country's national news agency with CaddyWiper data-wiping malware, which failed to impact its operations.
News URL
Related news
- Russian Sandworm hackers targeted 20 critical orgs in Ukraine (source)
- Microsoft: Russian hackers accessed internal systems, code repositories (source)
- Ukraine arrests hackers trying to sell 100 million stolen accounts (source)
- Russian Hackers May Have Targeted Ukrainian Telecoms with Upgraded 'AcidPour' Malware (source)
- Russian hackers target German political parties with WineLoader malware (source)
- Russian Hackers Use 'WINELOADER' Malware to Target German Political Parties (source)
- Russian Sandworm hackers pose as hacktivists in water utility breaches (source)
- Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028) (source)