Russia-Ukraine War: Phishing, Malware and Hacker Groups Taking Sides

Ukraine’s Computer system Emergency Reaction Team (CERT-UA) has warned of Belarusian point out-sponsored hackers concentrating on its armed forces personnel and associated individuals as part of a phishing campaign mounted amidst Russia’s army invasion of the region.

“Mass phishing emails have not too long ago been observed focusing on personal ‘i.ua’ and ‘meta.ua’ accounts of Ukrainian military services personnel and relevant folks,” the CERT-UA explained. “After the account is compromised, the attackers, by the IMAP protocol, get accessibility to all the messages.”

Subsequently, the attacks leverage the contact information and facts stored in the victim’s deal with e-book to propagate the phishing messages to other targets.

The Ukrainian govt attributed the activities to a danger actor tracked as UNC1151, a Minsk-dependent group whose “members are officers of the Ministry of Defence of the Republic of Belarus.” In a adhere to-up update, the company said the nation-point out team also targets its personal citizens, though at the same time location its sights on Russian entities –

• Association of Belarusians of the Planet (Global Social Union)
• Belarusian Tunes Competition
• Samara Oblasna General public Group “Russian-Belarusian Fraternity 2000”
• Dzêâslov, a Belarusian literary journal
• Soviet Belarus (Sovetskaya Belorussiya), a everyday newspaper in Belarus
• Employees of the National Academy of the Republic of Kazakhstan, and
• Voice of the Motherland, a nearby newspaper in Belarus

UNC1151 is the Mandiant-assigned moniker to an uncategorized risk cluster, which operates with goals that are aligned with Belarusian govt pursuits. The hacking group is thought to have been energetic because at minimum 2016.

“UNC1151 has targeted a extensive range of governmental and private sector entities, with a focus in Ukraine, Lithuania, Latvia, Poland, and Germany,” Mandiant scientists reported in a November 2021 report. “The focusing on also contains Belarusian dissidents, media entities, and journalists.”

The condition-backed cyber espionage group has also been linked to the Ghostwriter disinformation marketing campaign that promulgated anti-NATO and corruption-themed narratives aimed at Lithuania, Latvia, and Poland with the probably purpose of undermining the governments and developing tensions in the region.

What’s more, the January defacement attacks of a number of Ukrainian governing administration sites with threatening messages is thought to be the handiwork of UNC1151 as effectively.

Hacking Groups Take Sides

The progress follows a barrage of knowledge wiper and dispersed-denial-of-services (DDoS) attacks towards Ukrainian govt companies, even as numerous hacking teams and ransomware syndicates are capitalizing on the chaos to consider sides and even more their things to do.

“The Anonymous collective is officially in cyber war versus the Russian government,” the decentralized hacktivist group tweeted, introducing it “leaked the database of the Russian Ministry of Protection web page.”

One more group that has declared its fealty to Ukraine is the vigilante group known as GhostSec (short for Ghost Security), which declared it had flooded Russian navy sites with DDoS attacks “in guidance of the people in Ukraine.”

The Conti ransomware cartel, which not too long ago absorbed the now-shuttered TrickBot trojan, rallied its “complete guidance” powering the Russian authorities, threatening to “strike back again at the critical infrastructures of an enemy” should “any one will determine to organize a cyber attack or any war functions towards Russia.”

The team, nevertheless, later rephrased its assertion to condition that “we do not ally with any authorities and we condemn the ongoing war.” But Conti Team also taken care of that it “will use our complete capacity to provide retaliatory steps in circumstance the Western warmongers endeavor to target critical infrastructure in Russia or any Russian-speaking area of the planet.”

Other hacking entities to declare allegiance to Russia are the RedBanditsRU cybercrime team and the lesser-recognized CoomingProject ransomware software, which pledged to “enable the Russian governing administration if cyber attacks and perform against Russia.”

Discovered this report intriguing? Adhere to THN on Fb, Twitter  and LinkedIn to read a lot more exceptional content we put up.

Some sections of this posting are sourced from:
thehackernews.com