Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks

Cybersecurity scientists have unearthed a new affect procedure focusing on Ukraine that leverages spam email messages to propagate war-relevant disinformation.

The activity has been joined to Russia-aligned threat actors by Slovak cybersecurity enterprise ESET, which also identified a spear-phishing marketing campaign aimed at a Ukrainian defense organization in Oct 2023 and a European Union agency in November 2023 with an intention to harvest Microsoft login qualifications using pretend landing pages.

Procedure Texonto, as the full marketing campaign has been codenamed, has not been attributed to a unique risk actor, whilst some aspects of it, notably the spear-phishing attacks, overlap with COLDRIVER, which has a background of harvesting credentials through bogus indicator-in web pages.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The disinformation procedure took location above two waves in November and December 2023, with the email messages bearing PDF attachments and material associated to heating interruptions, drug shortages, and foods shortages.

The November wave qualified no fewer than a couple hundred recipients in Ukraine, such as the authorities, energy corporations, and persons. It’s at this time not acknowledged how the target checklist was developed.

“What is exciting to note is that the email was sent from a domain masquerading as the Ministry of Agrarian Policy and Foods of Ukraine, when the material is about drug shortages and the PDF is misusing the symbol of the Ministry of Health and fitness of Ukraine,” ESET stated in a report shared with The Hacker Information.

“It is perhaps a slip-up from the attackers or, at minimum, exhibits they did not treatment about all particulars.”

The 2nd disinformation email marketing campaign that commenced on December 25, 2023, is notable for increasing its targeting beyond Ukraine to include Ukrainian speakers in other European nations owing to the fact that all the messages are in Ukrainian.

These messages, while wishing recipients a happy holiday break year, also adopted a darker tone, heading as considerably as to counsel that they ampute just one of their arms or legs to steer clear of military services deployment. “A few of minutes of discomfort, but then a satisfied lifetime!,” the email goes.

ESET mentioned a single of the domains used to propagate the phishing email messages in December 2023, infonotification[.]com, also engaged in sending hundreds of spam messages commencing January 7, 2024, redirecting possible victims to a fake Canadian pharmacy website.

It can be exactly unclear why this email server was repurposed to propagate a pharmacy scam, but it is really suspected that the risk actors decided to monetize their infrastructure for economical gain following knowing that their domains have been detected by defenders.

“Operation Texonto shows yet a further use of systems to try to impact the war,” the firm stated.

The improvement arrives as Meta, in its quarterly Adversarial Threat Report, explained it took down three networks throughout its platforms originating from China, Myanmar, and Ukraine that engaged in coordinated inauthentic conduct (CIB).

Though none of the networks had been from Russia, social media analytics firm Graphika stated submitting volumes by Russian state-controlled media has declined 55% from pre-war concentrations and engagement has plummeted 94% compared to two years ago.

“Russian point out media retailers have amplified their concentration on non-political infotainment material and self-advertising narratives about Russia because the commence of the war,” it reported. “This could replicate a broader off-platform effort to cater to domestic Russian audiences immediately after several Western nations around the world blocked the retailers in 2022.”

Located this short article interesting? Stick to us on Twitter  and LinkedIn to examine a lot more special material we post.