Google uncovers Russian phishing campaign targeting Ukrainian news provider

Getty Pictures

Russian hackers have conducted numerous phishing strategies targeting end users of one particular of Ukraine’s most well-liked on line news vendors.

Which is in accordance to Google’s Risk Investigation Group (TAG), which has attributed the attacks to the Russia-backed APT28 gang, also known as FancyBear and Strontium.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The phishing email messages experienced been sent from a large variety of compromised non-Google accounts, and involved inbound links to newly-produced, attacker-managed Blogspot domains, which redirected targets to credential phishing webpages with the next domains:

• id-unconfirmeduser[.]frge[.]io
• hatdfg-rhgreh684[.]frge[.]io
• ua-consumerpanel[.]frge[.]io
• Consumerspanel[.]frge[.]io

The Blogspot domains have since been taken down, Google declared on Monday. The credential phishing pages are flagged as “dangerous” on the Google Chrome browser, as portion of Google’s Secure Searching support. Released in 2007, the assistance identifies unsafe internet websites throughout the web and notifies consumers and site proprietors of likely hurt with an attention-grabbing, pink warning information.

FancyBear’s phishing campaign in opposition to Ukr.net is just a person of numerous attempts by Russian and Belarusan danger actors to goal Ukrainian organisations.

The TAG crew has also been tracking the notorious Belarusan hacking team acknowledged as Ghostwriter, which it has noticed launching phishing attacks versus the Ukrainian and Polish governments. 

The tech big has also recorded recurring DDoS makes an attempt versus Ukraine’s Ministry of International Affairs, Ministry of Inner Affairs, as perfectly as companies like Liveuamap that are intended to assist individuals obtain data. This has prompted Google to expand the eligibility for its absolutely free DDoS protection instrument recognised as Task Protect, which sees Google soak up the inflow of “bad traffic” and hold the targeted website on the net. 

Google reported that “over 150 web sites in Ukraine, which include numerous information organisations, are using the service” and encouraged “all suitable organisations to register for Challenge Shield”.

Eligibility is determined on a rolling basis, with Google accepting Google Account holders that deal with or individual a web site in the news, human legal rights and political sectors.