ACTINIUM targets Ukrainian organizations

reasonablePrivacy · Feb 5, 2022

ACTINIUM targets Ukrainian organizations
February 4, 2022
Microsoft Threat Intelligence Center and Microsoft Digital Security Unit (DSU)
https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/

The Microsoft Threat Intelligence Center (MSTIC) is sharing information on a threat group named ACTINIUM, which has been operational for almost a decade and has consistently pursued access to organizations in Ukraine or entities related to Ukrainian affairs. MSTIC previously tracked ACTINIUM activity as DEV-0157, and this group is also referred to publicly as Gamaredon.
Click to expand...

reasonablePrivacy · Feb 8, 2022

These articles provide more information how this operation works at technical level

Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine
Palo Alto Networks, Unit 42
February 3, 2022
https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/

Monitoring these clusters, we observed an attempt to compromise a Western government entity in Ukraine on Jan. 19, 2022. We have also identified potential malware testing activity and reuse of historical techniques involving open-source virtual network computing (VNC) software. The sections below offer an overview of our findings in order to aid targeted entities in Ukraine as well as cybersecurity organizations in defending against this threat group.
Click to expand...

Shuckworm Continues Cyber-Espionage Attacks Against Ukraine
Symantec, Threat Hunter Team
31 Jan, 2022
https://symantec-enterprise-blogs.s...ligence/shuckworm-gamaredon-espionage-ukraine

The Russia-linked Shuckworm group (aka Gamaredon, Armageddon) is continuing to conduct cyber-espionage attacks against targets in Ukraine. Over the course of recent months, Symantec’s Threat Hunter Team, a part of Broadcom Software, has found evidence of attempted attacks against a number of organizations in the country.
Click to expand...

Table of Contents

Gamaredon Downloader Infrastructure (Cluster 1)
-Cluster 1 History
-Initial Downloaders
-SFX Files and UltraVNC
SSL Pivot to Additional Infrastructure and Samples
File Stealer (Cluster 2)
Pteranodon (Cluster 3)
Conclusion
-Protections and Mitigations
Indicators of Compromise
Additional Resources
Click to expand...

reasonablePrivacy · Jul 4, 2022

Russia launched cyber espionage campaigns against Ukraine allies: Microsoft
https://thehill.com/policy/cybersec...e-campaigns-against-ukraine-allies-microsoft/
06/22/22

“The Russian invasion relies in part on a cyber strategy that includes at least three distinct and sometimes coordinated efforts – destructive cyberattacks within Ukraine, network penetration and espionage outside Ukraine and cyber influence operations targeting people around the world,” Microsoft President Brad Smith said in the report. The tech giant previously detailed Russian cyber operations against Ukraine itself during the invasion in April.

Sixty-three percent of the observed Russian activity in the 42 countries beyond Ukraine targeted NATO members, according to the new report.
Click to expand...

Microsoft report can be found here: https://blogs.microsoft.com/on-the-...ing-ukraine-early-lessons-from-the-cyber-war/

Log in or Sign up

ACTINIUM targets Ukrainian organizations

reasonablePrivacy Registered Member

reasonablePrivacy Registered Member

reasonablePrivacy Registered Member

Log in or Sign up

ACTINIUM targets Ukrainian organizations

reasonablePrivacy Registered Member

reasonablePrivacy Registered Member

reasonablePrivacy Registered Member

Useful Searches