Security News > 2023 > September > Ukraine's CERT Thwarts APT28's Cyberattack on Critical Energy Infrastructure
The Computer Emergency Response Team of Ukraine on Tuesday said it thwarted a cyber attack against an unnamed critical energy infrastructure facility in the country.
"Visiting the link will download a ZIP archive containing three JPG images and a BAT file 'weblinks.cmd' to the victim's computer," CERT-UA said, attributing it to the Russian threat actor known as APT28.
"When a CMD file is run, several decoy web pages will be opened,.bat and.vbs files will be created, and a VBS file will be launched, which in turn will execute the BAT file."
The next phase of the attack involves running the "Whoami" command on the compromised host and exfiltrating the information, alongside downloading the TOR hidden service to route malicious traffic.
Site, which was recently disclosed as used by a threat actor known as Dark Pink.
Discover how Identity Threat Detection & Response identifies and mitigates threats with the help of SSPM. Learn how to secure your corporate SaaS applications and protect your data, even after a breach.
News URL
https://thehackernews.com/2023/09/ukraines-cert-thwarts-apt28s.html
Related news
- US critical infrastructure cyberattack reporting rules inch closer to reality (source)
- Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure (source)
- FBI: Critical infrastructure suffers spike in ransomware attacks (source)
- Major shifts in identity, ransomware, and critical infrastructure threat trends (source)
- Web-based PLC malware: A new potential threat to critical infrastructure (source)
- Email security trends in the energy and infrastructure sector (source)
- Public anxiety mounts over critical infrastructure resilience to cyber attacks (source)
- CISA shares critical infrastructure defense tips against Chinese hackers (source)
- FBI v the bots: Feds urge denial-of-service defense after critical infrastructure alert (source)
- US sanctions APT31 hackers behind critical infrastructure attacks (source)