{"id":18374,"date":"2022-02-25T13:10:07","date_gmt":"2022-02-25T21:10:07","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/02\/25\/news-12107\/"},"modified":"2022-02-25T13:10:07","modified_gmt":"2022-02-25T21:10:07","slug":"news-12107","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/25\/news-12107\/","title":{"rendered":"Cyber lures and threats in the context of the war in Ukraine"},"content":{"rendered":"<p><strong>Credit to Author: Threat Intelligence Team| Date: Fri, 25 Feb 2022 20:59:40 +0000<\/strong><\/p>\n<p>The conflict between Ukraine and Russia goes a long way back, but it took a dramatic turn after the 2014 Ukrainian revolution. Since then, the war in the Donbas region has resulted in a number of casualties as well as a constant feeling of insecurity among the population.<\/p>\n<p>In recent months, Russia increased its pressure on Ukraine by placing more and more troops along its Eastern border. At the same time, a number of destructive cyber attacks against government websites and other organizations took place.<\/p>\n<p>On February 24, Russia invaded Ukraine and started a full military conflict across that nation. While the kinetic war is by far the most pressing issue, cyber threats against Ukraine and Western countries are increasing as well.<\/p>\n<p>In this blog, we will review some of the threats that have primarily targeted Ukraine but could also spill over globally.<\/p>\n<h2>Constant APT attacks<\/h2>\n<p>The Russian APT group <a href=\"https:\/\/attack.mitre.org\/groups\/G0047\/\" target=\"_blank\" rel=\"noreferrer noopener\">Gamaredon<\/a> has been actively targeting Ukraine for a number of years. However in recent months the interest has reached a new level and this was <a href=\"https:\/\/unit42.paloaltonetworks.com\/gamaredon-primitive-bear-ukraine-update-2021\/\" target=\"_blank\" rel=\"noreferrer noopener\">observed<\/a> in campaigns using a number of lures. We caught one such sample recently that displays a decoy PDF of 40 pages supposedly detailing Russian military training:<\/p>\n<figure class=\"wp-block-gallery aligncenter columns-2 is-cropped\">\n<ul data-carousel-extra='{\"blog_id\":1,\"permalink\":\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\"}' class=\"blocks-gallery-grid\">\n<li class=\"blocks-gallery-item\">\n<figure><img decoding=\"async\" data-attachment-id=\"54574\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/attachment\/decoy_pdf_\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_.png\" data-orig-size=\"773,582\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"decoy_PDF_\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_-300x226.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_-600x452.png\" loading=\"lazy\" width=\"600\" height=\"452\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_-600x452.png\" alt=\"\" data-id=\"54574\" class=\"wp-image-54574\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_-600x452.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_-300x226.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/decoy_PDF_.png 773w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/figure>\n<\/li>\n<li class=\"blocks-gallery-item\">\n<figure><img decoding=\"async\" data-attachment-id=\"54576\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/attachment\/detection-13\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection.png\" data-orig-size=\"466,325\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"detection\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection-300x209.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection.png\" loading=\"lazy\" width=\"466\" height=\"325\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection.png\" alt=\"\" data-id=\"54576\" data-full-url=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection.png\" data-link=\"https:\/\/blog.malwarebytes.com\/?attachment_id=54576\" class=\"wp-image-54576\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection.png 466w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/detection-300x209.png 300w\" sizes=\"auto, (max-width: 466px) 100vw, 466px\" \/><\/figure>\n<\/li>\n<\/ul>\n<\/figure>\n<p>\u041d\u0430\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0435 \u0432 \u0412\u043e\u043e\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0421\u0438\u043b\u0430\u0445 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043e \u0434\u043b\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0438\u0440\u043e\u0432 (\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0438\u043a\u043e\u0432) \u0432\u0441\u0435\u0445 \u0441\u0442\u0435\u043f\u0435\u043d\u0435\u0439, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043a\u0438 \u043b\u0438\u0447\u043d\u043e\u0433\u043e \u0441\u043e\u0441\u0442\u0430\u0432\u0430.&nbsp;<\/p>\n<pre id=\"tw-target-text\" class=\"wp-block-preformatted\">The Manual on Physical Training in the Armed Forces of the Russian Federation is designed for commanders (chiefs) of all degrees, specialists in physical training, contains instructions and requirements for physical training of personnel.<\/pre>\n<p>The malicious archive not only contains a decoy, but also a VNC server that allows the attacker to gain access to the victim&#8217;s computer. The command and control server (licensecheckout[.]com) is hosted on 45.139.186[.]190 (Russia).<\/p>\n<h2>Destructive malware<\/h2>\n<p>In January, a new destructive malware dubbed <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2022\/01\/15\/destructive-malware-targeting-ukrainian-organizations\/\" target=\"_blank\" rel=\"noreferrer noopener\">WhisperGate<\/a> was unleashed against Ukrainian targets. It was followed in February by HermeticWiper, a piece of malware that is meant to render a machine unusable by corrupting the MBR partition.<\/p>\n<figure class=\"wp-block-gallery columns-2 is-cropped\">\n<ul data-carousel-extra='{\"blog_id\":1,\"permalink\":\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\"}' class=\"blocks-gallery-grid\">\n<li class=\"blocks-gallery-item\">\n<figure><img decoding=\"async\" data-attachment-id=\"54578\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/attachment\/overwritten_disk\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk.png\" data-orig-size=\"728,684\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"overwritten_disk\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk-300x282.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk-600x564.png\" loading=\"lazy\" width=\"600\" height=\"564\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk-600x564.png\" alt=\"\" data-id=\"54578\" class=\"wp-image-54578\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk-600x564.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk-300x282.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/overwritten_disk.png 728w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/figure>\n<\/li>\n<li class=\"blocks-gallery-item\">\n<figure><img decoding=\"async\" data-attachment-id=\"54581\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/attachment\/block-22\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block.png\" data-orig-size=\"771,726\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"block\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block-300x282.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block-600x565.png\" loading=\"lazy\" width=\"600\" height=\"565\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block-600x565.png\" alt=\"\" data-id=\"54581\" data-full-url=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block.png\" data-link=\"https:\/\/blog.malwarebytes.com\/?attachment_id=54581\" class=\"wp-image-54581\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block-600x565.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block-300x282.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/block.png 771w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><\/figure>\n<\/li>\n<\/ul>\n<\/figure>\n<p>Our Threat Intelligence team is currently analyzing this threat and will publish a technical report.<\/p>\n<h2>Retaliation threats<\/h2>\n<p>The infamous Conti ransomware group announced on February 25 that it will retaliate against any cyber (or physical) attack against Russia.<\/p>\n<blockquote class=\"wp-block-quote\">\n<p>The Conti Team is officially announcing a full support of Russian government. If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy.<\/p>\n<\/blockquote>\n<p>This was followed by another clarification:<\/p>\n<div data-carousel-extra='{\"blog_id\":1,\"permalink\":\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\"}' class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><a href=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_.png\" data-rel=\"lightbox-image-0\" data-rl_title=\"\" data-rl_caption=\"\" title=\"\"><img decoding=\"async\" data-attachment-id=\"54577\" data-permalink=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/attachment\/conti_\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_.png\" data-orig-size=\"1015,542\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"conti_\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_-300x160.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_-600x320.png\" loading=\"lazy\" width=\"1015\" height=\"542\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_.png\" alt=\"\" class=\"wp-image-54577\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_.png 1015w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_-300x160.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/conti_-600x320.png 600w\" sizes=\"auto, (max-width: 1015px) 100vw, 1015px\" \/><\/a><\/figure>\n<\/div>\n<p>If there ever was any doubt that some of the world&#8217;s most damaging ransomware groups were aligned with the Kremlin, this sort of allegiance will put an end to it.<\/p>\n<p>Since several countries have announced severe economic sanctions against Russia, we should expect retaliation via cyber means. Russia will perceive those sanctions as a direct attack against its economy, and they know how to respond in kind, not with sanctions but with cyber intrusions on critical infrastructure.<\/p>\n<h2>Uncertain times<\/h2>\n<p>Organizations have already faced the global ransomware threat for a number of years, and in many ways the same security recommendations continue to apply. What might be different is the intensity of attacks as well as the sheer determination from the adversary.&nbsp;For this reason, we would recommend following best practices outlined by <a href=\"https:\/\/www.cisa.gov\/shields-up\" target=\"_blank\" rel=\"noreferrer noopener\">CISA<\/a> and your country&#8217;s CERT.<\/p>\n<p>More than ever, individuals and organizations should be extremely vigilant to phishing attempts and preemptively hunt for possible threats within their environment. Remember to not only deploy but also properly configure your endpoint detection and response (EDR) solution.<\/p>\n<p>At Malwarebytes, we are tracking those cyber threats and ensuring that our customers continue to be protected. As always, please check back on this blog for the latest updates.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\">Cyber lures and threats in the context of the war in Ukraine<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Threat Intelligence Team| Date: Fri, 25 Feb 2022 20:59:40 +0000<\/strong><\/p>\n<p>There are many uncertainties with Russia&#8217;s invasion and war in Ukraine. In this unpredictable environment, we detail previous, current and expected cyber threats to watch out for.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/threat-intelligence\/2022\/02\/cyber-lures-and-threats-in-the-context-of-the-war-in-ukraine\/\">Cyber lures and threats in the context of the war in Ukraine<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[11029,3765,251,12040,8642,1552,16068],"class_list":["post-18374","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-apt","tag-ransomware","tag-russia","tag-threat-intelligence","tag-ukraine","tag-war","tag-wiper"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18374","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=18374"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18374\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=18374"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=18374"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=18374"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}