Russian APT Hackers Used COVID-19 Traps to Target European Diplomats

The Russia-linked threat actor, known as APT29, targeted European diplomatic missions and Foreign Ministries as part of a series of spear phishing campaigns in October and November 2021.

According to ESET's T3 2021 Threat Report shared with The Hacker News, the intrusions paved the way for the deployment of the Cobalt Strike Beacon on compromised systems, and then exploited the ground to drop additional malware to gather information about hosts and other machines on the same system. .

The advanced persistent threat group, also tracked under the names The Dukes, Cozy Bear, and Nobelium, is a vicious cyberespionage group that has been active for over a decade with attacks targeting Europe and the United States before gaining widespread attention. For SolarWinds' supply chain reconciliation, which led to more infections in many subsidiaries, including US government agencies, in 2020.

The spear phishing attacks began with a COVID-19-themed phishing email containing an HTML attachment from Iran's Ministry of Foreign Affairs that impersonated and, when opened, prompted recipients to open or save a file that looked like an ISO disc image file ("Covid.iso") ).

If the victim chooses to open or download the file, "a small piece of JavaScript decodes the ISO file directly embedded in the HTML attachment." The disk image file contains an HTML application, which in turn is executed using mshta.exe to run a piece of PowerShell code that installs the Cobalt Strike Beacon on the infected system.

SOURCE

News

All News

18 Teams of Istanbul Gelişim University are preparing to blow like a storm in the Teknofest Competition!

Istanbul Gelisim University is emerging as a hub of innovation, encouraging its students in R&D and technology. The university boasts 18 teams participating in Teknofest, one of Turkey's most prestigious technology competitions.

19 February 2024 Monday

Russian APT Hackers Used COVID-19 Traps to Target European Diplomats

The Russia-linked threat actor, known as APT29, targeted European diplomatic missions and Foreign Ministries as part of a series of spear phishing campaigns in October and November 2021.

03 February 2023 Friday

New Flaws Found in Cisco's Network Operating System for Switches

Cisco has released software updates to address four vulnerabilities in its software that could be weaponized by malicious actors to take control of affected systems.

03 February 2023 Friday

As a deliberate sabotage, the developer behind the popular "node-ipc" NPM package sent a tampered-up new version to denounce the Russian invasion of Ukraine, raising concerns about open source and security in the software supply chain.

03 February 2023 Friday

FBI Warns of BlackCat Ransomware Violating More than 60 Organizations Worldwide

ABD Federal Soruşturma Bürosu (FBI), geçen Kasım ayında ortaya çıkmasından bu yana Mart 2022 itibariyle dünya çapında en az 60 kuruluşu mağdur ettiğini söylediği BlackCat hizmet olarak fidye yazılımı (RaaS) için alarm veriyor.

03 February 2023 Friday

Twitter fined $150 million for using user data for unauthorized advertising purposes

Twitter, which is in the process of being acquired by Tesla CEO Elon Musk, has agreed to pay the US Federal Trade Commission (FTC) $150 million to resolve allegations that it misused non-public information collected for security purposes to serve targeted ads.

03 February 2023 Friday

Hackers use Mitel VoIP Zero-day in potential ransomware attack

A suspected ransomware attack against an anonymous target exploited a Mitel VoIP device as an entry point to perform remote code execution and provide initial access to the environment. The findings come from cybersecurity firm CrowdStrike, which traced the source of the attack to a Linux-based Mitel VoIP device located in the network perimeter, while also identifying a previously unknown exploit, as well as several actor-adopted forensics measures.

03 February 2023 Friday

Cybercrime Groups Are Increasingly Embracing the Ribbon Command and Control Framework

Nation-state threat actors are increasingly adopting and integrating the Sliver command and control (C2) framework in their intrusion campaigns, replacing Cobalt Strike.

03 February 2023 Friday

World universities were ranked according to their "Power of Impact": Istanbul Gelisim University has ranked 24th in Quality Education!

An organization ranking and evaluating world universities, Times Higher Education’s (THE) Impact Ranking 2021 results have been announced. In the ranking, Istanbul Gelisim University (IGU) has ranked 24th to provide the highest quality education among the universities in the world, and achieved a great success.

21 April 2021 Wednesday

Russian APT Hackers Used COVID-19 Traps to Target European Diplomats

Russian APT Hackers Used COVID-19 Traps to Target European Diplomats

The Russia-linked threat actor, known as APT29, targeted European diplomatic missions and Foreign Ministries as part of a series of spear phishing campaigns in October and November 2021.

News

Phone

FAX

EMAIL