Ukraine Continues to Face Cyber Espionage Attacks from Russian Hackers

Cybersecurity researchers on Monday said they uncovered evidence
of attempted attacks by a Russia-linked hacking operation targeting
a Ukrainian entity in July 2021.

Broadcom-owned Symantec, in a new report published Monday,
attributed the attacks to an actor tracked as Gamaredon (aka
Shuckworm or Armageddon), a cyber-espionage collective known to be
active since at least 2013.

In November 2021, Ukrainian intelligence agencies branded^[1]
the group as a “special project” of Russia’s Federal Security
Service (FSB), in addition to pointing fingers at it for carrying
out over 5,000 cyberattacks against public authorities and critical
infrastructure located in the country.

Gamaredon attacks typically originate with phishing emails that
trick the recipients into installing a custom remote access trojan
called Pterodo. Symantec disclosed that, between July 14, 2021 and
August 18, 2021, the actor installed several variants of the
backdoor as well as deployed additional scripts and tools.

“The attack chain began with a malicious document, likely sent
via a phishing email, which was opened by the user of the infected
machine,” the researchers said^[2]. The identity of the
affected organization was not disclosed.

Towards the end of July, the adversary leveraged the implant to
download and run an executable file that acted as a dropper for a
VNC client before establishing connections with a remote
command-and-control server under their control.

“This VNC client appears to be the ultimate payload for this
attack,” the researchers noted, adding the installation was
followed by accessing a number of documents ranging from job
descriptions to sensitive company information on the compromised
machine.

Ukraine Calls Out False Flag Operation in Wiper Attacks

The findings come amidst a wave of disruptive^[3]
and destructive attacks^[4]
levied against Ukrainian entities by alleged Russian
state-sponsored actors, resulting in the deployment of a file wiper
dubbed WhisperGate^[5], around the same time
multiple websites^[6]
belonging to the government were defaced.

Subsequent investigation^[7]
into the malware has since revealed^[8]
that the code used in the wiper was re-purposed from a faux
ransomware campaign called WhiteBlackCrypt that was aimed at
Russian victims in March 2021.

Interestingly, the ransomware is known to include a trident
symbol — that is part of Ukraine’s coat of arms^[9]
— in the ransom note it displays to its victims, leading Ukraine to
suspect that this may have been a false flag operation deliberately
intended to blame a “fake” pro-Ukrainian group for staging an
attack on their own government.