Security News > 2023 > April > Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

Elite hackers associated with Russia's military intelligence service have been linked to large-volume phishing campaigns aimed at hundreds of users in Ukraine to extract intelligence and influence public discourse related to the war.

The latest intrusion set, starting in early February 2023, involved the use of reflected cross-site scripting attacks in various Ukrainian government websites to redirect users to phishing domains and capture their credentials.

The credential harvesting campaign targeted CPC employees with phishing links delivered via SMS. The attacks against the energy vertical distributed links to fake Windows update packages that ultimately executed an information stealer known as Rhadamanthys to exfiltrate passwords and browser cookies.

FROZENBARENTS, dubbed the "Most versatile GRU cyber actor," has also been observed launching credential phishing attacks targeting the Ukrainian defense industry, military, and Ukr.net webmail users beginning in early December 2022.

A third threat actor of interest is PUSHCHA, a Belarusian government-backed group that's known to act on behalf of Russian interests, its targeted phishing attacks singling out Ukrainian webmail providers such as i.ua and meta.

Google TAG also highlighted a set of attacks mounted by the group behind Cuba ransomware to deploy RomCom RAT in the Ukrainian government and military networks.

News URL

https://thehackernews.com/2023/04/google-tag-warns-of-russian-hackers.html