cyble.com Open in urlscan Pro
192.0.78.152  Public Scan

URL: https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/
Submission: On December 13 via api from IN — Scanned from IL

Form analysis 3 forms found in the DOM

POST https://wordpress.com/email-subscriptions

<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog" data-cb-wrapper="true">
  <div class="wp-block-jetpack-subscriptions__form-elements">
    <p id="subscribe-email">
      <label id="subscribe-field-label" for="subscribe-field" class="screen-reader-text"> Type your email… </label>
      <input required="required" type="email" name="email" class="no-border-radius  has-ast-global-color-6-border-color" style="font-size: 16px;padding: 10px 15px 10px 15px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;"
        placeholder="Type your email…" value="" id="subscribe-field" title="Please fill in this field.">
    </p>
    <p id="subscribe-submit" style="width: ;max-width: 100%;">
      <input type="hidden" name="action" value="subscribe">
      <input type="hidden" name="blog_id" value="221651828">
      <input type="hidden" name="source" value="https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/">
      <input type="hidden" name="sub-type" value="subscribe-block">
      <input type="hidden" name="app_source" value="">
      <input type="hidden" name="redirect_fragment" value="subscribe-blog">
      <input type="hidden" name="lang" value="en_US">
      <input type="hidden" id="_wpnonce" name="_wpnonce" value="eaaf8f499d"><input type="hidden" name="_wp_http_referer" value="/blog/phishing-campaign-targeting-ukraine-uac-0215/"><input type="hidden" name="post_id" value="69814"> <button
        type="submit" class="wp-block-button__link no-border-radius has-ast-global-color-6-border-color"
        style="background: #cc0000;width: 100%;font-size: 16px;padding: 10px 15px 10px 15px;margin: 0; margin-left: 10px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe Now <span
          class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
            <path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
            <path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
          </svg></span></button>
    </p>
  </div>
</form>

GET https://cyble.com/

<form class="search-form" action="https://cyble.com/" method="get" data-cb-wrapper="true">
  <fieldset>
    <span class="text">
      <label for="search-field" class="screen-reader-text">Begin Search...</label>
      <input id="search-field" name="s" class="search-field" autocomplete="off" type="text" value="" placeholder="Begin Search..." tabindex="1">
    </span>
    <button aria-label="Search" id="search_submit" class="button search-submit" tabindex="2"><i class="astra-search-icon"> <span class="ast-icon icon-search"></span> </i></button>
  </fieldset>
</form>

POST https://wordpress.com/email-subscriptions

<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog-2" data-cb-wrapper="true">
  <div class="wp-block-jetpack-subscriptions__form-elements">
    <p id="subscribe-email">
      <label id="subscribe-field-2-label" for="subscribe-field-2" class="screen-reader-text"> Type your email… </label>
      <input required="required" type="email" name="email" style="font-size: 16px;padding: 15px 23px 15px 23px;border-radius: 50px;border-width: 1px;" placeholder="Type your email…" value="" id="subscribe-field-2" title="Please fill in this field.">
    </p>
    <p id="subscribe-submit">
      <input type="hidden" name="action" value="subscribe">
      <input type="hidden" name="blog_id" value="221651828">
      <input type="hidden" name="source" value="https://cyble.com/blog/phishing-campaign-targeting-ukraine-uac-0215/">
      <input type="hidden" name="sub-type" value="subscribe-block">
      <input type="hidden" name="app_source" value="atomic-subscription-modal-lo">
      <input type="hidden" name="redirect_fragment" value="subscribe-blog-2">
      <input type="hidden" name="lang" value="en_US">
      <input type="hidden" id="_wpnonce" name="_wpnonce" value="eaaf8f499d"><input type="hidden" name="_wp_http_referer" value="/blog/phishing-campaign-targeting-ukraine-uac-0215/"><input type="hidden" name="post_id" value="69814"> <button
        type="submit" class="wp-block-button__link" style="font-size: 16px;padding: 15px 23px 15px 23px;margin: 0; margin-left: 10px;border-radius: 50px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe <span
          class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
            <path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
            <path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
          </svg></span></button>
    </p>
  </div>
</form>

Text Content

Skip to content
 * CISA Enhances Public Safety Communications with Seven New Resources in Cyber
   Resiliency Toolkit 

Switch to Cyble

Report an Incident

Talk to Sales

We are Hiring!

Login
Login
 * ProductsMenu Toggle
   * For Enterprises(B2B) and GovernmentsMenu Toggle
     * AI-Driven Threat Intelligence Products
     * Cyble VisionFor Enterprises
       Award-winning cyber threat intelligence platform, designed to provide
       enhanced security through real-time intelligence and threat detection.
     * Cyble HawkFor Federal Bodies
       Protects sensitive information and assets from cyber threats with its
       specialized threat detection and intelligence capabilities built for
       federal bodies.
   * For Enterprises(B2B) and Individuals(B2C)Menu Toggle
     * AmIBreached
       Enables consumers and organizations to Identify, Prioritize and Mitigate
       darkweb risks.
     * Odin by CybleNew
       The most advanced internet-scanning tool in the industry for real-time
       threat detection and cybersecurity
     * The Cyber ExpressSubscribe
       #1 Trending Cyber Security News and Magazine
   * We’ve just released an update!
     Cyble has an update that enhances ASM, CTI and more...
     Menu Toggle
     * Schedule a Demo
 * SolutionsMenu Toggle
   * AI-Driven Cyber Threat Intelligence SolutionsPowered by AIMenu Toggle
     * Attack Surface Management
       Ensure digital security by identifying and mitigating threats with
       Cyble's Attack Surface Management
     * Brand Intelligence
       Comprehensive protection against online brand abuse, including brand
       impersonation, phishing, and fraudulent domains.
     * Cyber Threat Intelligence
       Gain insights and enhance your defense with AI-driven analysis and
       continuous threat monitoring
     * Dark Web Monitoring
       Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark
       Web Monitoring.
     * Vulnerability Management
       
       Advanced scanning, risk evaluation, and efficient remediation strategies
       to protect against cyber threats.
     * Takedown and Disruption
       
       Fight cybercrime with Cyble’s top takedown services—remove fraud sites,
       content, and disrupt malicious campaigns.
   * Menu ItemMenu Toggle
     * Third Party Risk Management
       
       Identify and mitigate third-party risks to keep your business secure in
       external collaborations.
     * Digital Forensics & Incident Response
       
       Cyble offers comprehensive DFIR services to help businesses manage,
       mitigate, and recover from cyber incidents.
     * Physical Security Intelligence
       
       Monitor multiple locations on one platform with real-time alerts, AI
       insights, and tailored threat notifications for proactive security.
     * Executive Monitoring
       Protect your leadership with proactive threat detection, covering
       impersonations, PII leaks, and dark web monitoring with prompt alerts.
     * Cloud Security Posture Management (CSPM)
       Manage and secure cloud assets with Cyble’s CSPM, ensuring compliance and
       proactive risk detection across cloud and on-premises environments.
   * Solutions by Industry
     
     Menu Toggle
     * Healthcare & Pharmaceuticals
     * Financial Services
       
     * Retail and CPG
     * Technology Industry
     * Educational Platform
     * Solutions by Role
       
     * Information Security
     * Corporate Security
     * Marketing
       
 * Why Cyble?Menu Toggle
   * Compare CybleMenu Toggle
     * Industry RecognitionAwards
     * Customer Stories
 * ResourcesMenu Toggle
   * Thought LeadershipMenu Toggle
     * Blog
       Discover the latest in cybersecurity with Cyble's blog, featuring a
       wealth of articles, research findings, and insights. CRIL is an
       invaluable resource for anyone interested in the evolving world of cyber
       threats and defenses, offering expert analysis and updates.
     * Knowledge Hub
     * Threat Actor Profiles
     * SAMA Compliance
     * Events
       Conferences, Webinars, Training sessions and more…
   * Data SheetsMenu Toggle
     * Case Studies
       Dive into Cyble's case studies to discover real-world applications of
       their cybersecurity solutions. These studies provide valuable insights
       into how Cyble addresses various cyber threats and enhances digital
       security for different organizations.
     * Research Reports
        * Country Reports
        * Industry Reports
        * Ransomware Reports
     
     * WhitepapersDownload
     * External Threat Assessment ReportDownload Report
   * Research ReportsLatest Report
     
     Menu Toggle
     * Free Tools
        * Scan The Dark Web
        * Scan The Internet
 * CompanyMenu Toggle
   * Our Story
     Learn about Cyble's journey and mission in the cybersecurity landscape.
     Menu Toggle
     * Leadership Team
       Meet our leadership team.
     * CareersWe are hiring!
       Explore a career with Cyble and contribute to cutting-edge cybersecurity
       solutions. Check out Cyble's career opportunities.
     * Press
 * PartnersMenu Toggle
   * Cyble Partner Network (CPN)Join Us
     Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
     This platform offers unique opportunities for partnerships, fostering
     growth and shared success in tackling cyber threats together.
     Menu Toggle
     * Partner Login
     * Become a PartnerRegister
       Elevate your cybersecurity business with the Cyble Partner Network:
       Access cutting-edge tools, expert support, and growth opportunities.
       Ideal for MSSPs, resellers, and alliances.


Free Trial
Free Trial
Main Menu
 * ProductsMenu Toggle
   * For Enterprises(B2B) and GovernmentsMenu Toggle
     * AI-Driven Threat Intelligence Products
     * Cyble VisionFor Enterprises
       Award-winning cyber threat intelligence platform, designed to provide
       enhanced security through real-time intelligence and threat detection.
     * Cyble HawkFor Federal Bodies
       Protects sensitive information and assets from cyber threats with its
       specialized threat detection and intelligence capabilities built for
       federal bodies.
   * For Enterprises(B2B) and Individuals(B2C)Menu Toggle
     * AmIBreached
       Enables consumers and organizations to Identify, Prioritize and Mitigate
       darkweb risks.
     * Odin by CybleNew
       The most advanced internet-scanning tool in the industry for real-time
       threat detection and cybersecurity
     * The Cyber ExpressSubscribe
       #1 Trending Cyber Security News and Magazine
   * We’ve just released an update!
     Cyble has an update that enhances ASM, CTI and more...
     Menu Toggle
     * Schedule a Demo
 * SolutionsMenu Toggle
   * AI-Driven Cyber Threat Intelligence SolutionsPowered by AIMenu Toggle
     * Attack Surface Management
       Ensure digital security by identifying and mitigating threats with
       Cyble's Attack Surface Management
     * Brand Intelligence
       Comprehensive protection against online brand abuse, including brand
       impersonation, phishing, and fraudulent domains.
     * Cyber Threat Intelligence
       Gain insights and enhance your defense with AI-driven analysis and
       continuous threat monitoring
     * Dark Web Monitoring
       Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark
       Web Monitoring.
     * Vulnerability Management
       
       Advanced scanning, risk evaluation, and efficient remediation strategies
       to protect against cyber threats.
     * Takedown and Disruption
       
       Fight cybercrime with Cyble’s top takedown services—remove fraud sites,
       content, and disrupt malicious campaigns.
   * Menu ItemMenu Toggle
     * Third Party Risk Management
       
       Identify and mitigate third-party risks to keep your business secure in
       external collaborations.
     * Digital Forensics & Incident Response
       
       Cyble offers comprehensive DFIR services to help businesses manage,
       mitigate, and recover from cyber incidents.
     * Physical Security Intelligence
       
       Monitor multiple locations on one platform with real-time alerts, AI
       insights, and tailored threat notifications for proactive security.
     * Executive Monitoring
       Protect your leadership with proactive threat detection, covering
       impersonations, PII leaks, and dark web monitoring with prompt alerts.
     * Cloud Security Posture Management (CSPM)
       Manage and secure cloud assets with Cyble’s CSPM, ensuring compliance and
       proactive risk detection across cloud and on-premises environments.
   * Solutions by Industry
     
     Menu Toggle
     * Healthcare & Pharmaceuticals
     * Financial Services
       
     * Retail and CPG
     * Technology Industry
     * Educational Platform
     * Solutions by Role
       
     * Information Security
     * Corporate Security
     * Marketing
       
 * Why Cyble?Menu Toggle
   * Compare CybleMenu Toggle
     * Industry RecognitionAwards
     * Customer Stories
 * ResourcesMenu Toggle
   * Thought LeadershipMenu Toggle
     * Blog
       Discover the latest in cybersecurity with Cyble's blog, featuring a
       wealth of articles, research findings, and insights. CRIL is an
       invaluable resource for anyone interested in the evolving world of cyber
       threats and defenses, offering expert analysis and updates.
     * Knowledge Hub
     * Threat Actor Profiles
     * SAMA Compliance
     * Events
       Conferences, Webinars, Training sessions and more…
   * Data SheetsMenu Toggle
     * Case Studies
       Dive into Cyble's case studies to discover real-world applications of
       their cybersecurity solutions. These studies provide valuable insights
       into how Cyble addresses various cyber threats and enhances digital
       security for different organizations.
     * Research Reports
        * Country Reports
        * Industry Reports
        * Ransomware Reports
     
     * WhitepapersDownload
     * External Threat Assessment ReportDownload Report
   * Research ReportsLatest Report
     
     Menu Toggle
     * Free Tools
        * Scan The Dark Web
        * Scan The Internet
 * CompanyMenu Toggle
   * Our Story
     Learn about Cyble's journey and mission in the cybersecurity landscape.
     Menu Toggle
     * Leadership Team
       Meet our leadership team.
     * CareersWe are hiring!
       Explore a career with Cyble and contribute to cutting-edge cybersecurity
       solutions. Check out Cyble's career opportunities.
     * Press
 * PartnersMenu Toggle
   * Cyble Partner Network (CPN)Join Us
     Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
     This platform offers unique opportunities for partnerships, fostering
     growth and shared success in tackling cyber threats together.
     Menu Toggle
     * Partner Login
     * Become a PartnerRegister
       Elevate your cybersecurity business with the Cyble Partner Network:
       Access cutting-edge tools, expert support, and growth opportunities.
       Ideal for MSSPs, resellers, and alliances.


TRENDING

TARGETED INDUSTRIES -> IT & ITES | Technology | Government & LEA | Healthcare |
BFSITARGETED COUNTRIES -> United States | Russian Federation | China | United
Kingdom | GermanyTARGETED REGIONS -> North America (NA) | Europe & UK | Asia &
Pacific (APAC) | Middle East & Africa (MEA) | Australia and New Zealand
(ANZ)IOCs -> a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 |
7bdbd180c081fa63ca94f9c22c457376 |
c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 |
8c69830a50fb85d8a794fa46643493b2 | bbcf7a68f4164a9f5f5cb2d9f30d9790CVEs ->
CVE-2024-21887 | CVE-2023-46805 | CVE-2017-11882 | CVE-2024-21893 |
CVE-2021-44228TECHNIQUES -> T1082 | T1140 | T1486 | T1083 | T1105TACTICS ->
TA505 | TA0011 | TA0002 | TA0001 | TA453TAGS -> security | the-cyber-express |
firewall-daily | the-cyber-express-news | malwareTHREAT ACTORS -> Lockbit |
Blackcat | Lazarus | VoltTyphoon | KimsukyMALWARE -> CobaltStrike | Qakbot |
Xmrig | Lockbit | IcedidSOURCES -> Darkreading | The Cyber Express |
Bleepingcomputer | The Hacker News | Infosecurity Magazine

Home » Blog » Phishing Campaign Targeting Ukraine: UAC-0215 Threatens National
Security


 * Phishing

 * October 29, 2024


PHISHING CAMPAIGN TARGETING UKRAINE: UAC-0215 THREATENS NATIONAL SECURITY

Threat actor UAC-0215 launches a phishing campaign threatening Ukraine's public,
industrial, and military sectors.


OVERVIEW



CERT-UA, the Cyber Emergency Response Team for Ukraine, uncovered a phishing
campaign orchestrated by the threat actor UAC-0215. This campaign specifically
targeted public institutions, major industries, and military units across
Ukraine.   

The phishing emails were cleverly disguised to promote integration with popular
platforms like Amazon and Microsoft, as well as advocating for Zero Trust
Architecture (ZTA). However, the emails contained malicious .rdp configuration
files that, when opened, established a connection to an attacker-controlled
server.   



This connection provided unauthorized access to a variety of local resources,
including disk drives, network assets, printers, audio devices, and even the
clipboard. The sophistication of this campaign raises security concerns for
critical infrastructure in Ukraine.  


CAMPAIGN OVERVIEW  



The campaign was first detected on October 22, 2024, with intelligence
suggesting that the preparatory groundwork was laid as early as August 2024. The
phishing operation’s extensive reach highlights not only a localized threat but
also a broader international concern, as multiple cybersecurity organizations
worldwide have corroborated it. The implications of this attack extend beyond
individual organizations, threatening national security.  

The primary targets of the phishing campaign include public authorities, major
industries, and military organizations within Ukraine. This operation is
assessed to have a high-risk score, indicating a threat to these sectors. The
campaign is attributed to the advanced persistent threat (APT) group known as
UAC-0215, utilizing rogue Remote Desktop Protocol (RDP) techniques.  


TECHNICAL DETAILS



The phishing campaign attributed to UAC-0215 utilizes rogue Remote Desktop
Protocol (RDP) files to infiltrate key Ukrainian institutions. The malicious
emails are designed to appear legitimate, enticing recipients to open
attachments that ultimately compromise their systems. When a victim unwittingly
opens the .rdp configuration file, it connects their computer to the attacker’s
server, granting extensive access to critical local resources, including:  

Your browser does not support the video tag.
 1. Disk Drives  

 2. Network Resources  

 3. Printers  

 4. COM Ports  

 5. Audio Devices  

 6. Clipboard  

 7. This access allows the attackers to execute unauthorized scripts and
    programs, further compromising the system.  


CONCLUSION  



The intelligence gathered suggests that the UAC-0215 campaign extends beyond
Ukrainian targets, indicating a potential for broader cyberattacks across
multiple regions, especially amid heightened tensions in the area, including
recent cyberattacks on Ukraine that have garnered international concern.   

This campaign highlights the growing sophistication of phishing tactics employed
against Ukraine, as the attackers exploited RDP configurations to gain
significant control over critical systems within public and industrial sectors,
jeopardizing sensitive information and operational integrity.   


RECOMMENDATIONS AND MITIGATIONS  



To mitigate the risks posed by UAC-0215 and similar threats, organizations are
advised to implement the following strategies:  

 * Establish better filtering rules at the mail gateway to block emails
   containing .rdp file attachments. This measure is critical in reducing
   exposure to malicious configurations.  

 * Limit users’ ability to execute .rdp files unless specifically authorized.
   This precaution will minimize the risk of accidental executions that could
   lead to breaches.  

 * Configure firewall settings to prevent the Microsoft Remote Desktop client
   (mstsc.exe) from establishing RDP connections to external, internet-facing
   resources. This step will thwart unintended remote access and reduce the
   potential for exploitation.  

 * Utilize Group Policy to disable resource redirection in RDP sessions. By
   setting restrictions under “Device and Resource Redirection” in Remote
   Desktop Services, organizations can prevent attackers from accessing local
   resources during RDP sessions. 


RELATED






GET THREAT ASSESSMENT REPORT

Identify External Threats Targeting Your Business
Get My Report
Free
Your browser does not support the video tag.
 * 
 * 






CISO’S GUIDE TO THREAT INTELLIGENCE 2024: BEST PRACTICES

Stay Ahead of Cyber Threats with Expert Insights and Strategies. Download Free
E-Book Now

Search for your darkweb exposure



Use Cyble's Largest Dark Web Monitoring Engine to Assess Your Exposure. Make
Sure You're Aware of the Risks by Searching Through Our 150,447,938,145 Records!
We Have Over 50,000 Data Breaches, Several Hacking Forums, Conversations
Indexed.

Download Now


Cybercrime Magazine · AI's Impact On Cybersecurity. Microsoft Recall & Beyond.
Beenu Arora, Co-Founder & CEO, Cyble.

Business Email Address*

Type your email…

Subscribe Now

Share the Post:

PrevPreviousU.S. Agencies Investigate China-Linked Telecom Hacks Targeting
High-Profile Politicians
NextRansomware Vulnerability Matrix: A Comprehensive Resource for Cybersecurity
Analysts Next


RELATED POSTS

CISA ENHANCES PUBLIC SAFETY COMMUNICATIONS WITH SEVEN NEW RESOURCES IN CYBER
RESILIENCY TOOLKIT 

December 12, 2024

HACKTIVIST ALLIANCES TARGET FRANCE AMIDST POLITICAL CRISIS

December 12, 2024

Quick Links
Main Menu

 * Home
 * About Us
 * Blog
 * Cyble Partner Network (CPN)
 * Press
 * Responsible Disclosure
 * Knowledge Hub
 * Sitemap

Threat Intelligence Products & Platforms
Main Menu

 * AmIBreached
 * Cyble Vision
 * Cyble Hawk
 * Cyble Odin
 * The Cyber Express

Solutions
Main Menu

 * Attack Surface Management
 * Brand Intelligence
 * Threat Intelligence Platform
 * Dark Web Monitoring
 * Takedown and Disruption
 * Vulnerability Management
 * Third-Party Risk Management (TPRM)
 * Physical Threat Intelligence
 * Executive Monitoring
 * Cloud Security Posture Management (CSPM)

Privacy Policy
Main Menu

 * AmIBreached
 * Cyble Vision
 * Cyble Trust Portal

Schedule a Personalized Demo to Uncover Threats That No One Tells You
Book a Demo
© 2024. Cyble Inc.(#1 Threat Intelligence Platform Company). All Rights Reserved

Made with ❤️ from Cupertino

Twitter Linkedin Youtube
Request a demo
Upcoming Events
Research Reports
Talk To Sales



START TYPING AND PRESS ENTER TO SEARCH

Begin Search...

Scroll to Top


DISCOVER MORE FROM CYBLE

Subscribe now to keep reading and get access to the full archive.

Type your email…

Subscribe

Continue reading



We use cookies to ensure that we give you the best experience on our website. If
you continue to use this site we will assume that you are happy with it.Ok








Stay ahead in Cybersecurity with Cyble Research. You can unsubscribe at any
time.


AllowCancel