Hackers believed to be associated with the governments of Russia, Belarus and China are targeting Ukraine, Poland and European governments, researchers say, ranging from espionage attempts to phishing campaigns and coinciding with the intensification of the Russian assault on Ukraine.
Shane Huntley, the director of Google’s Threat Analysis Group (TAG), said in a blog post Monday that the group has observed well-known Russian military hacking group Fancy Bear (also known as APT28) conducting several large credential phishing campaigns targeting UkrNet, a Ukrainian media company. Two recent campaigns, he said, involved newly created Blogspot domains as initial landing pages, which then redirected targets to credential phishing pages.
TAG also observed a hacking operation known as Ghostwriter, or UNC1151, running credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations.
Ghostwriter refers to activity believed to be operating out of Belarus, researchers with cybersecurity firm Mandiant reported in November.
Separately, Ukraine’s Computer Emergency Response Team published details Monday about ongoing UNC1151 targeting of Ukrainian information sources with MicroBackdoor malware. That malware creates a backdoor, but also takes screenshots on target machines.
Google further said Monday that TAG identified malicious file attachments targeting European entities with lures related to the Ukrainian invasion, and attributed the activity to a China-based hacking group known variously as Mustang Panda or Temp.Hex. “Targeting of European organizations has represented a shift from Mustang Panda’s regularly observed Southeast Asian targets,” Huntley wrote.
Researchers with cybersecurity firm Proofpoint released their own detailed analysis of that Chinese activity on Monday, saying the group is targeting European diplomatic entities, including an individual involved in refugee and migrant services. While Google said the Mustang Panda hacking in Europe was a shift, Proofpoint’s analysis differed, suggesting a “multiyear campaign against diplomatic entities in Europe,” which “suggests a consistent area of responsibility.”
-In this Story-
APT28, Belarus, China, Fancy Bear, Ghostwriter, Google, Mustang Panda, Proofpoint, Russia, TA416, Temp.Hex, Ukraine, UNC1151