CERT-UA Warns of Phishing Attacks Targeting Ukraine’s Defense and Security Force

Category	Details
Threat Actors	UAC-0185 (also known as UNC4221), a Russia-linked threat actor.
Campaign Overview	Phishing attacks targeting defense companies and Ukraine’s security forces, aimed at stealing credentials and gaining system control.
Target Regions (Or Victims)	Ukraine, defense companies, security and defense forces.
Methodology	– Phishing emails mimicking official communications. – Malicious URLs download a Windows shortcut file. – HTML Application executes PowerShell commands to load payloads and grant remote control.
Product Targeted	Messaging apps (Signal, Telegram, WhatsApp), Ukrainian military systems (DELTA, Teneta, Kropyva), Windows operating systems.
Malware Reference	MeshAgent binary (for remote access control).
Tools Used	– Windows shortcut files. – HTML Applications. – Batch scripts. – PowerShell commands.
Vulnerabilities Exploited	Social engineering (phishing emails).
TTPs	– Credential stealing. – Remote access persistence. – Multi-stage payload delivery (shortcut file, HTML Application, PowerShell commands).
Attribution	UAC-0185 (UNC4221), attributed to a Russia-linked group.
Recommendations	– Use email filtering and phishing detection tools. – Implement robust endpoint protection and monitoring. – Secure messaging platforms and communication tools against unauthorized access.
Source	The Hackers News

Read full article:https://thehackernews.com/2024/12/cert-ua-warns-of-phishing-attacks.html

Disclaimer: The above summary has been generated by an AI language model