Ukraine’s DELTA Military System Users Under Attack from Info Stealing Malware

Dec 21, 2022Ravie LakshmananCyber War / Cyber Attack

The Computer Emergency Response Team of Ukraine (CERT-UA) this
week disclosed^[1]
that users of the Delta situational awareness program received
phishing emails from a compromised email account belonging to the
Ministry of Defense.

The attacks, which have been attributed to a threat cluster
dubbed UAC-0142, aimed to infect systems with two pieces of
data-stealing malware referred to as FateGrab and
StealDeal.

Delta^[2]
is a cloud-based operational situation display system developed by
Aerorozvidka that allows real-time monitoring of troops on the
battlefield, making it a lucrative target for threat actors.

The lure messages, which come with fake warnings to update root
certificates in the Delta software, carry PDF documents containing
links to archive files hosted on a fraudulent Delta domain,
ultimately dropping the malware on compromised systems.

While FateGrab is mainly designed to exfiltrate files with
specific extensions through File Transfer Protocol (FTP^[3]), StealDeal singles out
web browsers to siphon passwords and other information.

The attack comes days after Ukraine presented the Delta system^[4] to the NATO
Consultation, Command, and Control Organization (NC3O^[5]). It also follows
revelations^[6]
that the Russia-linked Gamaredon group attempted to unsuccessfully
infiltrate a large petroleum refining company within a NATO member
state in late August 2022.

The Russo-Ukrainian war has prompted Moscow to intensify
cyberattacks against Ukraine, relying on a wide range of wiper malware^[7] to disrupt critical
infrastructure.

Ukrainian organizations, in recent months, have also been
targeted with RomCom RAT^[8]
and Vidar stealer, the latter of which has been found to act as a
conduit to drop a ransomware strain called Somnia^[9].

Earlier this month, CERT-UA noted that state-owned organizations
have been targeted with phishing emails purporting to be from the
State Emergency Service of Ukraine and containing weaponzied RAR
archives that are engineered to deploy a Delphi-based backdoor
named DolphinCape^[10].