Ukraine’s CERT Foils APT28 Cyberattack Aimed at Energy Infrastructure
September 6, 2023
Ukraine's Computer Emergency Response Team (CERT-UA) reported on Tuesday that it had successfully averted a cyber attack on a critical energy infrastructure facility within the nation. The attack was initiated by a phishing email that contained a link to a malicious ZIP archive, initiating the infection chain. CERT-UA stated, "Visiting the link will download a ZIP archive containing three JPG images (decoys) and a BAT file 'weblinks.cmd' to the victim's computer," attributing the attack to the Russian threat actor known as APT28, also referred to as BlueDelta, Fancy Bear, Forest Blizzard, or FROZENLAKE.
When the CMD file is executed, several decoy web pages open, and .bat and .vbs files are created. A VBS file is then launched, which subsequently executes the BAT file. The next stage of the attack involves running the 'whoami' command on the compromised host and exfiltrating the data, and the TOR hidden service is downloaded to route malicious traffic. The attack achieves persistence through a scheduled task, and remote command execution is facilitated using cURL via a legitimate service called webhook.site, which was recently revealed to be utilized by a threat actor known as Dark Pink.
CERT-UA reported that the attack was ultimately unsuccessful due to restricted access to Mocky and the Windows Script Host (wscript.exe). It is important to note that APT28 has been previously associated with the use of Mocky APIs.
The revelation of this thwarted attack comes in the context of ongoing phishing attacks against Ukraine, some of which have been observed using a malware obfuscation engine called ScruptCrypt to distribute AsyncRAT. Another cyberattack, attributed to GhostWriter (also known as UAC-0057 or UNC1151), reportedly exploited a recently disclosed zero-day flaw in WinRAR (CVE-2023-38831, CVSS score: 7.8) to deploy PicassoLoader and Cobalt Strike.
Related News
- CISA Mandates Immediate Patching for Two Actively Exploited Vulnerabilities
- Exploitation of WinRAR Zero-Day Vulnerability to Breach Cryptocurrency Trading Accounts
Latest News
- Emerging Cloud Attack Vector: A Case Study on MinIO Exploitation
- Google Patches Android Zero-Day Exploit with September 2023 Security Updates
- MinIO Storage System Exploited by Hackers to Infiltrate Corporate Networks
- Critical VMware SSH Authentication Bypass Vulnerability Exploited: Details and Mitigation
- Kinsing Cybercrime Group Targets OpenFire Cloud Servers with New Attack Vector
Like what you see?
Get a digest of headlines, vulnerabilities, risk context, and more delivered to your inbox.
