Ukraine Warns of Cyber attack Aiming to Hack Users’ Telegram Messenger Accounts

Ukraine’s technical security and intelligence service is warning
of a new wave of cyber attacks that are aimed at gaining access to
users’ Telegram accounts.

“The criminals sent messages with malicious links to the
Telegram website in order to gain unauthorized access to the
records, including the possibility to transfer a one-time code from
SMS,” the State Service of Special Communication and Information
Protection (SSSCIP) of Ukraine said^[1]
in an alert.

The attacks^[2], which have been
attributed to a threat cluster called “UAC-0094,” originate with
Telegram messages alerting recipients that a login had been
detected from a new device located in Russia and urging the users
to confirm their accounts by clicking on a link.

The URL, in reality a phishing domain, prompts the victims to
enter their phone numbers as well as the one-time passwords sent
via SMS that are then used by the threat actors to take over the
accounts.

The modus operandi mirrors^[3]
that of an earlier phishing attack that was disclosed in early
March that leveraged compromised inboxes belonging to different
Indian entities to send phishing emails to users of Ukr.net to
hijack the accounts.

In another social engineering campaign^[4] observed by Ukraine’s
Computer Emergency Response Team (CERT-UA), war-related email lures
were sent to Ukrainian government agencies to deploy a piece of
espionage malware.

The emails come with an HTML file attachment (“War Criminals of
the Russian Federation.htm”), opening which culminates in the
download and execution of a PowerShell-based implant on the
infected host.

CERT-UA attributed the attack to Armageddon^[5], a Russia-based threat
actor with ties to the Federal Security Service (FSB) that has a
history^[6]
of striking Ukrainian entities^[7] since at least 2013.

In February 2022, the hacking group was connected^[8]
to espionage attacks targeting government, military, non-government
organizations (NGO), judiciary, law enforcement, and non-profit
organizations with the main goal of exfiltrating sensitive
information.

Armageddon, also known by the moniker Gamaredon, is also
believed to have singled out Latvian government officials as part
of a related phishing attack^[9]
towards the end of March 2022, employing war-themed RAR archives to
deliver malware.

Other phishing campaigns documented by CERT-UA in recent weeks
have deployed a variety of malware, including GraphSteel,
GrimPlant^[10], HeaderTip^[11], LoadEdge^[12], and SPECTR^[13], not to mention a
Ghostwriter^[14]-spearheaded operation^[15] to install the Cobalt
Strike post-exploitation framework.

The disclosure comes as several advanced persistent threat (APT)
groups from Iran, China, North Korea, and Russia have capitalized^[16] on the ongoing
Russo-Ukrainian war as a pretext to backdoor victim networks and
stage other malicious activities.