cyble.com
Open in
urlscan Pro
192.0.78.152
Public Scan
URL:
https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/
Submission: On December 13 via api from IN — Scanned from IL
Submission: On December 13 via api from IN — Scanned from IL
Form analysis
3 forms found in the DOMPOST https://wordpress.com/email-subscriptions
<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog" data-cb-wrapper="true">
<div class="wp-block-jetpack-subscriptions__form-elements">
<p id="subscribe-email">
<label id="subscribe-field-label" for="subscribe-field" class="screen-reader-text"> Type your email… </label>
<input required="required" type="email" name="email" class="no-border-radius has-ast-global-color-6-border-color" style="font-size: 16px;padding: 10px 15px 10px 15px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;"
placeholder="Type your email…" value="" id="subscribe-field" title="Please fill in this field.">
</p>
<p id="subscribe-submit" style="width: ;max-width: 100%;">
<input type="hidden" name="action" value="subscribe">
<input type="hidden" name="blog_id" value="221651828">
<input type="hidden" name="source" value="https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/">
<input type="hidden" name="sub-type" value="subscribe-block">
<input type="hidden" name="app_source" value="">
<input type="hidden" name="redirect_fragment" value="subscribe-blog">
<input type="hidden" name="lang" value="en_US">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="eaaf8f499d"><input type="hidden" name="_wp_http_referer" value="/blog/phishing-campaign-targeting-ukraine-uac-0215/"><input type="hidden" name="post_id" value="69814"> <button
type="submit" class="wp-block-button__link no-border-radius has-ast-global-color-6-border-color"
style="background: #cc0000;width: 100%;font-size: 16px;padding: 10px 15px 10px 15px;margin: 0; margin-left: 10px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe Now <span
class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
<path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
<path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
</svg></span></button>
</p>
</div>
</form>
GET https://cyble.com/
<form class="search-form" action="https://cyble.com/" method="get" data-cb-wrapper="true">
<fieldset>
<span class="text">
<label for="search-field" class="screen-reader-text">Begin Search...</label>
<input id="search-field" name="s" class="search-field" autocomplete="off" type="text" value="" placeholder="Begin Search..." tabindex="1">
</span>
<button aria-label="Search" id="search_submit" class="button search-submit" tabindex="2"><i class="astra-search-icon"> <span class="ast-icon icon-search"></span> </i></button>
</fieldset>
</form>
POST https://wordpress.com/email-subscriptions
<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog-2" data-cb-wrapper="true">
<div class="wp-block-jetpack-subscriptions__form-elements">
<p id="subscribe-email">
<label id="subscribe-field-2-label" for="subscribe-field-2" class="screen-reader-text"> Type your email… </label>
<input required="required" type="email" name="email" style="font-size: 16px;padding: 15px 23px 15px 23px;border-radius: 50px;border-width: 1px;" placeholder="Type your email…" value="" id="subscribe-field-2" title="Please fill in this field.">
</p>
<p id="subscribe-submit">
<input type="hidden" name="action" value="subscribe">
<input type="hidden" name="blog_id" value="221651828">
<input type="hidden" name="source" value="https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/">
<input type="hidden" name="sub-type" value="subscribe-block">
<input type="hidden" name="app_source" value="atomic-subscription-modal-lo">
<input type="hidden" name="redirect_fragment" value="subscribe-blog-2">
<input type="hidden" name="lang" value="en_US">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="eaaf8f499d"><input type="hidden" name="_wp_http_referer" value="/blog/phishing-campaign-targeting-ukraine-uac-0215/"><input type="hidden" name="post_id" value="69814"> <button
type="submit" class="wp-block-button__link" style="font-size: 16px;padding: 15px 23px 15px 23px;margin: 0; margin-left: 10px;border-radius: 50px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe <span
class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
<path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
<path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
</svg></span></button>
</p>
</div>
</form>
Text Content
Skip to content * CISA Enhances Public Safety Communications with Seven New Resources in Cyber Resiliency Toolkit Switch to Cyble Report an Incident Talk to Sales We are Hiring! Login Login * ProductsMenu Toggle * For Enterprises(B2B) and GovernmentsMenu Toggle * AI-Driven Threat Intelligence Products * Cyble VisionFor Enterprises Award-winning cyber threat intelligence platform, designed to provide enhanced security through real-time intelligence and threat detection. * Cyble HawkFor Federal Bodies Protects sensitive information and assets from cyber threats with its specialized threat detection and intelligence capabilities built for federal bodies. * For Enterprises(B2B) and Individuals(B2C)Menu Toggle * AmIBreached Enables consumers and organizations to Identify, Prioritize and Mitigate darkweb risks. * Odin by CybleNew The most advanced internet-scanning tool in the industry for real-time threat detection and cybersecurity * The Cyber ExpressSubscribe #1 Trending Cyber Security News and Magazine * We’ve just released an update! Cyble has an update that enhances ASM, CTI and more... Menu Toggle * Schedule a Demo * SolutionsMenu Toggle * AI-Driven Cyber Threat Intelligence SolutionsPowered by AIMenu Toggle * Attack Surface Management Ensure digital security by identifying and mitigating threats with Cyble's Attack Surface Management * Brand Intelligence Comprehensive protection against online brand abuse, including brand impersonation, phishing, and fraudulent domains. * Cyber Threat Intelligence Gain insights and enhance your defense with AI-driven analysis and continuous threat monitoring * Dark Web Monitoring Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark Web Monitoring. * Vulnerability Management Advanced scanning, risk evaluation, and efficient remediation strategies to protect against cyber threats. * Takedown and Disruption Fight cybercrime with Cyble’s top takedown services—remove fraud sites, content, and disrupt malicious campaigns. * Menu ItemMenu Toggle * Third Party Risk Management Identify and mitigate third-party risks to keep your business secure in external collaborations. * Digital Forensics & Incident Response Cyble offers comprehensive DFIR services to help businesses manage, mitigate, and recover from cyber incidents. * Physical Security Intelligence Monitor multiple locations on one platform with real-time alerts, AI insights, and tailored threat notifications for proactive security. * Executive Monitoring Protect your leadership with proactive threat detection, covering impersonations, PII leaks, and dark web monitoring with prompt alerts. * Cloud Security Posture Management (CSPM) Manage and secure cloud assets with Cyble’s CSPM, ensuring compliance and proactive risk detection across cloud and on-premises environments. * Solutions by Industry Menu Toggle * Healthcare & Pharmaceuticals * Financial Services * Retail and CPG * Technology Industry * Educational Platform * Solutions by Role * Information Security * Corporate Security * Marketing * Why Cyble?Menu Toggle * Compare CybleMenu Toggle * Industry RecognitionAwards * Customer Stories * ResourcesMenu Toggle * Thought LeadershipMenu Toggle * Blog Discover the latest in cybersecurity with Cyble's blog, featuring a wealth of articles, research findings, and insights. CRIL is an invaluable resource for anyone interested in the evolving world of cyber threats and defenses, offering expert analysis and updates. * Knowledge Hub * Threat Actor Profiles * SAMA Compliance * Events Conferences, Webinars, Training sessions and more… * Data SheetsMenu Toggle * Case Studies Dive into Cyble's case studies to discover real-world applications of their cybersecurity solutions. These studies provide valuable insights into how Cyble addresses various cyber threats and enhances digital security for different organizations. * Research Reports * Country Reports * Industry Reports * Ransomware Reports * WhitepapersDownload * External Threat Assessment ReportDownload Report * Research ReportsLatest Report Menu Toggle * Free Tools * Scan The Dark Web * Scan The Internet * CompanyMenu Toggle * Our Story Learn about Cyble's journey and mission in the cybersecurity landscape. Menu Toggle * Leadership Team Meet our leadership team. * CareersWe are hiring! Explore a career with Cyble and contribute to cutting-edge cybersecurity solutions. Check out Cyble's career opportunities. * Press * PartnersMenu Toggle * Cyble Partner Network (CPN)Join Us Join Cyble's Partner Network to collaborate and innovate in cybersecurity. This platform offers unique opportunities for partnerships, fostering growth and shared success in tackling cyber threats together. Menu Toggle * Partner Login * Become a PartnerRegister Elevate your cybersecurity business with the Cyble Partner Network: Access cutting-edge tools, expert support, and growth opportunities. Ideal for MSSPs, resellers, and alliances. Free Trial Free Trial Main Menu * ProductsMenu Toggle * For Enterprises(B2B) and GovernmentsMenu Toggle * AI-Driven Threat Intelligence Products * Cyble VisionFor Enterprises Award-winning cyber threat intelligence platform, designed to provide enhanced security through real-time intelligence and threat detection. * Cyble HawkFor Federal Bodies Protects sensitive information and assets from cyber threats with its specialized threat detection and intelligence capabilities built for federal bodies. * For Enterprises(B2B) and Individuals(B2C)Menu Toggle * AmIBreached Enables consumers and organizations to Identify, Prioritize and Mitigate darkweb risks. * Odin by CybleNew The most advanced internet-scanning tool in the industry for real-time threat detection and cybersecurity * The Cyber ExpressSubscribe #1 Trending Cyber Security News and Magazine * We’ve just released an update! Cyble has an update that enhances ASM, CTI and more... Menu Toggle * Schedule a Demo * SolutionsMenu Toggle * AI-Driven Cyber Threat Intelligence SolutionsPowered by AIMenu Toggle * Attack Surface Management Ensure digital security by identifying and mitigating threats with Cyble's Attack Surface Management * Brand Intelligence Comprehensive protection against online brand abuse, including brand impersonation, phishing, and fraudulent domains. * Cyber Threat Intelligence Gain insights and enhance your defense with AI-driven analysis and continuous threat monitoring * Dark Web Monitoring Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark Web Monitoring. * Vulnerability Management Advanced scanning, risk evaluation, and efficient remediation strategies to protect against cyber threats. * Takedown and Disruption Fight cybercrime with Cyble’s top takedown services—remove fraud sites, content, and disrupt malicious campaigns. * Menu ItemMenu Toggle * Third Party Risk Management Identify and mitigate third-party risks to keep your business secure in external collaborations. * Digital Forensics & Incident Response Cyble offers comprehensive DFIR services to help businesses manage, mitigate, and recover from cyber incidents. * Physical Security Intelligence Monitor multiple locations on one platform with real-time alerts, AI insights, and tailored threat notifications for proactive security. * Executive Monitoring Protect your leadership with proactive threat detection, covering impersonations, PII leaks, and dark web monitoring with prompt alerts. * Cloud Security Posture Management (CSPM) Manage and secure cloud assets with Cyble’s CSPM, ensuring compliance and proactive risk detection across cloud and on-premises environments. * Solutions by Industry Menu Toggle * Healthcare & Pharmaceuticals * Financial Services * Retail and CPG * Technology Industry * Educational Platform * Solutions by Role * Information Security * Corporate Security * Marketing * Why Cyble?Menu Toggle * Compare CybleMenu Toggle * Industry RecognitionAwards * Customer Stories * ResourcesMenu Toggle * Thought LeadershipMenu Toggle * Blog Discover the latest in cybersecurity with Cyble's blog, featuring a wealth of articles, research findings, and insights. CRIL is an invaluable resource for anyone interested in the evolving world of cyber threats and defenses, offering expert analysis and updates. * Knowledge Hub * Threat Actor Profiles * SAMA Compliance * Events Conferences, Webinars, Training sessions and more… * Data SheetsMenu Toggle * Case Studies Dive into Cyble's case studies to discover real-world applications of their cybersecurity solutions. These studies provide valuable insights into how Cyble addresses various cyber threats and enhances digital security for different organizations. * Research Reports * Country Reports * Industry Reports * Ransomware Reports * WhitepapersDownload * External Threat Assessment ReportDownload Report * Research ReportsLatest Report Menu Toggle * Free Tools * Scan The Dark Web * Scan The Internet * CompanyMenu Toggle * Our Story Learn about Cyble's journey and mission in the cybersecurity landscape. Menu Toggle * Leadership Team Meet our leadership team. * CareersWe are hiring! Explore a career with Cyble and contribute to cutting-edge cybersecurity solutions. Check out Cyble's career opportunities. * Press * PartnersMenu Toggle * Cyble Partner Network (CPN)Join Us Join Cyble's Partner Network to collaborate and innovate in cybersecurity. This platform offers unique opportunities for partnerships, fostering growth and shared success in tackling cyber threats together. Menu Toggle * Partner Login * Become a PartnerRegister Elevate your cybersecurity business with the Cyble Partner Network: Access cutting-edge tools, expert support, and growth opportunities. Ideal for MSSPs, resellers, and alliances. TRENDING TARGETED INDUSTRIES -> IT & ITES | Technology | Government & LEA | Healthcare | BFSITARGETED COUNTRIES -> United States | Russian Federation | China | United Kingdom | GermanyTARGETED REGIONS -> North America (NA) | Europe & UK | Asia & Pacific (APAC) | Middle East & Africa (MEA) | Australia and New Zealand (ANZ)IOCs -> a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | 7bdbd180c081fa63ca94f9c22c457376 | c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 | 8c69830a50fb85d8a794fa46643493b2 | bbcf7a68f4164a9f5f5cb2d9f30d9790CVEs -> CVE-2024-21887 | CVE-2023-46805 | CVE-2017-11882 | CVE-2024-21893 | CVE-2021-44228TECHNIQUES -> T1082 | T1140 | T1486 | T1083 | T1105TACTICS -> TA505 | TA0011 | TA0002 | TA0001 | TA453TAGS -> security | the-cyber-express | firewall-daily | the-cyber-express-news | malwareTHREAT ACTORS -> Lockbit | Blackcat | Lazarus | VoltTyphoon | KimsukyMALWARE -> CobaltStrike | Qakbot | Xmrig | Lockbit | IcedidSOURCES -> Darkreading | The Cyber Express | Bleepingcomputer | The Hacker News | Infosecurity Magazine Home » Blog » Phishing Campaign Targeting Ukraine: UAC-0215 Threatens National Security * Phishing * October 29, 2024 PHISHING CAMPAIGN TARGETING UKRAINE: UAC-0215 THREATENS NATIONAL SECURITY Threat actor UAC-0215 launches a phishing campaign threatening Ukraine's public, industrial, and military sectors. OVERVIEW CERT-UA, the Cyber Emergency Response Team for Ukraine, uncovered a phishing campaign orchestrated by the threat actor UAC-0215. This campaign specifically targeted public institutions, major industries, and military units across Ukraine. The phishing emails were cleverly disguised to promote integration with popular platforms like Amazon and Microsoft, as well as advocating for Zero Trust Architecture (ZTA). However, the emails contained malicious .rdp configuration files that, when opened, established a connection to an attacker-controlled server. This connection provided unauthorized access to a variety of local resources, including disk drives, network assets, printers, audio devices, and even the clipboard. The sophistication of this campaign raises security concerns for critical infrastructure in Ukraine. CAMPAIGN OVERVIEW The campaign was first detected on October 22, 2024, with intelligence suggesting that the preparatory groundwork was laid as early as August 2024. The phishing operation’s extensive reach highlights not only a localized threat but also a broader international concern, as multiple cybersecurity organizations worldwide have corroborated it. The implications of this attack extend beyond individual organizations, threatening national security. The primary targets of the phishing campaign include public authorities, major industries, and military organizations within Ukraine. This operation is assessed to have a high-risk score, indicating a threat to these sectors. The campaign is attributed to the advanced persistent threat (APT) group known as UAC-0215, utilizing rogue Remote Desktop Protocol (RDP) techniques. TECHNICAL DETAILS The phishing campaign attributed to UAC-0215 utilizes rogue Remote Desktop Protocol (RDP) files to infiltrate key Ukrainian institutions. The malicious emails are designed to appear legitimate, enticing recipients to open attachments that ultimately compromise their systems. When a victim unwittingly opens the .rdp configuration file, it connects their computer to the attacker’s server, granting extensive access to critical local resources, including: Your browser does not support the video tag. 1. Disk Drives 2. Network Resources 3. Printers 4. COM Ports 5. Audio Devices 6. Clipboard 7. This access allows the attackers to execute unauthorized scripts and programs, further compromising the system. CONCLUSION The intelligence gathered suggests that the UAC-0215 campaign extends beyond Ukrainian targets, indicating a potential for broader cyberattacks across multiple regions, especially amid heightened tensions in the area, including recent cyberattacks on Ukraine that have garnered international concern. This campaign highlights the growing sophistication of phishing tactics employed against Ukraine, as the attackers exploited RDP configurations to gain significant control over critical systems within public and industrial sectors, jeopardizing sensitive information and operational integrity. RECOMMENDATIONS AND MITIGATIONS To mitigate the risks posed by UAC-0215 and similar threats, organizations are advised to implement the following strategies: * Establish better filtering rules at the mail gateway to block emails containing .rdp file attachments. This measure is critical in reducing exposure to malicious configurations. * Limit users’ ability to execute .rdp files unless specifically authorized. This precaution will minimize the risk of accidental executions that could lead to breaches. * Configure firewall settings to prevent the Microsoft Remote Desktop client (mstsc.exe) from establishing RDP connections to external, internet-facing resources. This step will thwart unintended remote access and reduce the potential for exploitation. * Utilize Group Policy to disable resource redirection in RDP sessions. By setting restrictions under “Device and Resource Redirection” in Remote Desktop Services, organizations can prevent attackers from accessing local resources during RDP sessions. RELATED GET THREAT ASSESSMENT REPORT Identify External Threats Targeting Your Business Get My Report Free Your browser does not support the video tag. * * CISO’S GUIDE TO THREAT INTELLIGENCE 2024: BEST PRACTICES Stay Ahead of Cyber Threats with Expert Insights and Strategies. Download Free E-Book Now Search for your darkweb exposure Use Cyble's Largest Dark Web Monitoring Engine to Assess Your Exposure. Make Sure You're Aware of the Risks by Searching Through Our 150,447,938,145 Records! We Have Over 50,000 Data Breaches, Several Hacking Forums, Conversations Indexed. Download Now Cybercrime Magazine · AI's Impact On Cybersecurity. Microsoft Recall & Beyond. Beenu Arora, Co-Founder & CEO, Cyble. Business Email Address* Type your email… Subscribe Now Share the Post: PrevPreviousU.S. Agencies Investigate China-Linked Telecom Hacks Targeting High-Profile Politicians NextRansomware Vulnerability Matrix: A Comprehensive Resource for Cybersecurity Analysts Next RELATED POSTS CISA ENHANCES PUBLIC SAFETY COMMUNICATIONS WITH SEVEN NEW RESOURCES IN CYBER RESILIENCY TOOLKIT December 12, 2024 HACKTIVIST ALLIANCES TARGET FRANCE AMIDST POLITICAL CRISIS December 12, 2024 Quick Links Main Menu * Home * About Us * Blog * Cyble Partner Network (CPN) * Press * Responsible Disclosure * Knowledge Hub * Sitemap Threat Intelligence Products & Platforms Main Menu * AmIBreached * Cyble Vision * Cyble Hawk * Cyble Odin * The Cyber Express Solutions Main Menu * Attack Surface Management * Brand Intelligence * Threat Intelligence Platform * Dark Web Monitoring * Takedown and Disruption * Vulnerability Management * Third-Party Risk Management (TPRM) * Physical Threat Intelligence * Executive Monitoring * Cloud Security Posture Management (CSPM) Privacy Policy Main Menu * AmIBreached * Cyble Vision * Cyble Trust Portal Schedule a Personalized Demo to Uncover Threats That No One Tells You Book a Demo © 2024. Cyble Inc.(#1 Threat Intelligence Platform Company). All Rights Reserved Made with ❤️ from Cupertino Twitter Linkedin Youtube Request a demo Upcoming Events Research Reports Talk To Sales START TYPING AND PRESS ENTER TO SEARCH Begin Search... Scroll to Top DISCOVER MORE FROM CYBLE Subscribe now to keep reading and get access to the full archive. Type your email… Subscribe Continue reading We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.Ok Stay ahead in Cybersecurity with Cyble Research. You can unsubscribe at any time. AllowCancel