APT28 Employs Windows Update Lures to Trick Ukrainian Targets
The phishing emails were sent using names of system administrators and a letter containing instructions to protect against hackers.
![a hook inside a digital triangular warning symbol with code in the background a hook inside a digital triangular warning symbol with code in the background](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltbb46cb8a3aac7e9a/64f15456a720e87c12bc392b/Phishing_Andrea_Danti_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The Russia-linked APT28 hacking group targeted Ukrainian government bodies in a spear-phishing campaign that uses phony "Windows Update" guides.
In April, CERT-UA observed malicious emails being sent on Microsoft Outlook from what appeared to be system administrators at government bodies — with a subject line that read "Windows Update." The emails sought to trick the recipients into "launching a command line and executing a PowerShell command."
Operating out of military unit 26165 of the Russian General Staff Main Intelligence Directorate (GRU), the APT28 group has been known to be active since 2007 and has targeted a variety of operations globally, including governments, security organizations, militaries, and the 2016 US presidential election.
"The mentioned command will download a PowerShell script that, simulating the process of updating the operating system, will download and execute the following PowerShell script designed to collect basic information about the computer using the 'tasklist', 'systeminfo' commands, and send the received results using HTTP request to the Mocky service API," the CERT-UA alert stated.
Going forward, CERT-UA recommends that organizations placing restrictions on PowerShell use and monitor network connections to the Mocky service API. The NCSC, NSA, CISA, and FBI was also released a joint advisory with information on tactics, techniques, and procedures (TTPs) connected with APT28's attacks.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024