#certua — Public Fediverse posts

Vediamo come il gruppo UAC-0099 ha trasformato un’agenda per gatti in una backdoor contro le infrastrutture ucraine

https://insicurezzadigitale.com/vediamo-come-il-gruppo-uac-0099-ha-trasformato-unagenda-per-gatti-in-una-backdoor-contro-le-infrastrutture-ucraine/

TrendAI says Earth Sirrush has targeted Ukrainian government services, defense organizations, border guards and transport and supply companies since at least 2022.

Researchers link the group to Russia; that attribution remains an assessment.

Reported methods include messages impersonating official bodies and files or software that appear ordinary.

In July 2026, CERT-UA documented a harmful Notepad++ add-on.

TrendAI de…

https://en.hacks.gr/omada-poy-syndeetai-me-ti-rosia-stocheyei-oykranikoys-foreis-apo-to-2022/

#EarthSirrush #NotepadPlusPlus #CERTUA #Ukraine

CERT-UA Warns of 100+ Sites Serving LunexStealer via Fake Cloudflare Checks

Beware of over 100 compromised websites serving up the nasty LunexStealer malware by masquerading as a Cloudflare verification page - just a click away from trouble! When you visit these sites, you're tricked into executing a command that lets the malware swipe your sensitive info.

https://osintsights.com/cert-ua-warns-of-100-sites-serving-lunexstealer-via-fake-cloudflare-checks?utm_source=mastodon&utm_medium=social

#Lunexstealer #Uac0277 #Certua #MalwareOperations #EmergingThreats

CERT-UA reports an escalation in mobile cyberattacks targeting Ukrainian officials using the DarkSword iOS exploit and Android malware like CamelSpy.

#CERTUA #Cybersecurity #MobileSecurity #DarkSword #Malware

https://meterpreter.org/ukraine-cert-ua-mobile-cyberattacks/?utm_source=mastodon&utm_medium=jetpack_social

🇺🇦 🇷🇺 Ruská skupina útočí na ozbrojené síly Ukrajiny odkazy na „nadace“

https://infoek.cz/ruska-skupina-utoci-na-ozbrojene-sily-ukrajiny-odkazy-na-nadace-2026/

🇺🇦 🇷🇺 Russian group attacks Ukraine's armed forces, links to "foundations"

https://infoek-cz.translate.goog/ruska-skupina-utoci-na-ozbrojene-sily-ukrajiny-odkazy-na-nadace-2026/?_x_tr_sl=cs&_x_tr_tl=en&_x_tr_hl=cs&_x_tr_pto=wapp

#CyberSecurity #Russia #Ukraine #StandWithUkraine #RussiaUkrainianWar #CERTUA #LaundryBear

UAC-0099 Attack Detection: Hackers Target Government and Defense Agencies in Ukraine Using MATCHBOIL, MATCHWOK, and DRAGSTARE Malware – Source: socprime.com https://ciso2ciso.com/uac-0099-attack-detection-hackers-target-government-and-defense-agencies-in-ukraine-using-matchboil-matchwok-and-dragstare-malware-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #socprimecom #socprime #CERT-UA #CERTUA #Blog

UAC-0001 (APT28) Attack Detection: The russia-Backed Actor Uses LLM-Powered LAMEHUG Malware to Target Security and Defense Sector  – Source: socprime.com https://ciso2ciso.com/uac-0001-apt28-attack-detection-the-russia-backed-actor-uses-llm-powered-lamehug-malware-to-target-security-and-defense-sector-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #socprimecom #Phishing #socprime #CERT-UA #CERTUA #APT28 #Blog

UAC-0001 (APT28) Activity Detection: The russian State-Sponsored Group Targets Government Agencies Using BEARDSHELL and COVENANT Malware – Source: socprime.com https://ciso2ciso.com/uac-0001-apt28-activity-detection-the-russian-state-sponsored-group-targets-government-agencies-using-beardshell-and-covenant-malware-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #socprimecom #BEARDSHELL #COVENANT #socprime #CERT-UA #CERTUA #APT28 #Blog

Ukrainian Government Systems Targeted With Backdoors Hidden in Cloud APIs and Docs https://thecyberexpress.com/ukrainian-government-systems-targeted/ #UkrainianGovernmentSystems #TheCyberExpressNews #TheCyberExpress #FirewallDaily #CyberWarfare #MalwareNews #CyberNews #Espionage #FancyBear #Phishing #CERTUA #Russia #Signal #APT28 #APT28 #ICS

Ukraine Reports 48% Jump in Cyber Incidents in H2 2024, but 77% Drop in High-Severity Incidents https://thecyberexpress.com/cyber-incidents-in-h2-2024-ukraine/ #Ukrainecyberincident #TheCyberExpressNews #Ukrainecyberwarfare #Ukrainecyberattacks #VulnerabilityNews #malwareplaybook #TheCyberExpress #kineticattacks #FirewallDaily #CyberWarfare #ThreatActors #MalwareNews #CERTUkraine #GeoServer #Features #CERTUA

UAC-0226 Attack Detection: New Cyber-Espionage Campaign Targeting Ukrainian Innovation Hubs and Government Entities with GIFTEDCROOK Stealer – Source: socprime.com https://ciso2ciso.com/uac-0226-attack-detection-new-cyber-espionage-campaign-targeting-ukrainian-innovation-hubs-and-government-entities-with-giftedcrook-stealer-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #GIFTEDCROOK #socprimecom #Phishing #socprime #CERT-UA #UAC0226 #CERTUA #14303 #Blog

UAC-0219 Attack Detection: A New Cyber-Espionage Campaign Using a PowerShell Stealer WRECKSTEEL – Source: socprime.com https://ciso2ciso.com/uac-0219-attack-detection-a-new-cyber-espionage-campaign-using-a-powershell-stealer-wrecksteel-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #Latestthreats #socprimecom #WRECKSTEEL #Phishing #socprime #CERT-UA #UAC0219 #CERTUA #14283 #Blog

In March, #CERTUA observed cyber-espionage attacks against Ukrainian state bodies and critical infrastructure by #UAC0219 spreading #WRECKSTEEL stealer for data theft. Detect potential intrusions with #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/detect-uac-0219-attacks-against-ukrainian-state-bodies/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

#CERTUA warns defenders about a targeted cyber-espionage operation by #UAC0200 targeting the Armed Forces of Ukraine. Detect associated malicious activity with #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/detect-uac-0200-attacks-using-darkcrystal-rat/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

UAC-0200 Attack Detection: Cyber-Espionage Activity Targeting Defense Industry Sector and the Armed Forces of Ukraine Using DarkCrystal RAT – Source: socprime.com https://ciso2ciso.com/uac-0200-attack-detection-cyber-espionage-activity-targeting-defense-industry-sector-and-the-armed-forces-of-ukraine-using-darkcrystal-rat-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DarkCrystalRAT #DARKCRYSTALRAT #Latestthreats #socprimecom #socprime #CERT-UA #UAC0200 #CERTUA #14045 #Blog

Hackers Exploit RDP Tools to Breach Ukraine’s Notarial Offices, CERT-UA Reports https://thecyberexpress.com/uac-0173-cyberattack/ #StateSpecialCommunicationsService #MinistryofJusticeofUkraine #TheCyberExpressNews #UserAccountControl #TheCyberExpress #DataBreachNews #FirewallDaily #HackerNews #CyberNews #UAC0173 #CERTUA

UAC-0173 Activity Detection: Hackers Launch Phishing Attacks Against Ukrainian Notaries Using the DARKCRYSTALRAT Malware – Source: socprime.com https://ciso2ciso.com/uac-0173-activity-detection-hackers-launch-phishing-attacks-against-ukrainian-notaries-using-the-darkcrystalrat-malware-source-socprime-com/ #rssfeedpostgeneratorecho #CyberSecurityNews #DARKCRYSTALRAT #Latestthreats #socprimecom #Phishing #socprime #CERT-UA #UAC0173 #CERTUA #13738 #Blog

#CERTUA warns defenders of a surge in phishing attacks by #UAC0173 against Ukrainian notaries to gain remote access and modify state registries. Detect increasing malicious activity with #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/detect-uac-0173-attacks-against-ukrainian-notaries/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

#CERTUA warns defenders of targeted activity to launch cyber-attacks against the critical infrastructure sector in Ukraine and beyond linked to UAC-0212, a subcluster of #Sandworm #APT. Detect intrusions with #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/detecting-uac-0212-attacks-linked-to-sandworm/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

Hackers Exploit AnyDesk Impersonating CERT-UA to Launch Cyber-Attacks  – Source: socprime.com https://ciso2ciso.com/hackers-exploit-anydesk-impersonating-cert-ua-to-launch-cyber-attacks-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #Cyberattack #socprimecom #socprime #CERT-UA #CERTUA #Sigma #Blog

#CERTUA warns defenders of #cyberattacks impersonating CERT-UA activity under the guise of security audits via #AnyDesk misuse. Detect relevant malicious activity and hosts using AnyDesk with curated #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/anydesk-exploitation-attack-detection/?utm_source=mastodon&utm_medium=social&utm_campaign=latest-threats&utm_content=blog-post

#CERTUA alerts cyber defenders about new attacks on Ukraine by #UAC0125, using fake websites that imitate the "Army+" app page, hosted via Cloudflare Workers. Detect #cyberattacks with Sigma rules and explore campaign details on our blog.
https://socprime.com/blog/uac-0125-attacks-against-ukraine-detection/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

#cybersecurity

#CERTUA alerts on #UAC0099 cyber-espionage attacks against Ukrainian state bodies spreading LONEPAGE #malware. Detect adversary activity with curated #Sigma rules from SOC Prime Platform.
https://socprime.com/blog/uac-0099-cyber-espionage-attacks-detection/?utm_source=mastodon&utm_medium=social&utm_campaign=cert-ua&utm_content=blog-post

#CERTUA warns of #UAC0185 (aka #UNC4221) attacks against Ukrainian Defense Forces and military-industrial sector. Detect associated malicious activity with a set of Sigma rules in the SOC Prime Platform. More insights in our blog!
https://bit.ly/4imGM4d

UAC-0001 aka APT28 Attack Detection: Leveraging PowerShell Command in Clipboard as Initial Entry Point – Source: socprime.com https://ciso2ciso.com/uac-0001-aka-apt28-attack-detection-leveraging-powershell-command-in-clipboard-as-initial-entry-point-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #Vulnerability #Cyberattack #socprimecom #Phishing #socprime #CERT-UA #CERTUA #Blog

UAC-0218 Attack Detection: Adversaries Steal Files Using HOMESTEEL Malware – Source: socprime.com https://ciso2ciso.com/uac-0218-attack-detection-adversaries-steal-files-using-homesteel-malware-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #CERT-UA11717 #Cyberattack #socprimecom #socprime #CERT-UA #Malware #CERTUA #Sigma #Blog

CERT-UA Report: UAC-0198: Mass distribution of ANONVNC (MESHAGENT) among government organizations of Ukraine

According to the report, cyber operations related to the ongoing military conflict between Russia and Ukraine are ongoing. The report highlights the potential risks and threats posed by Russian state-sponsored actors, including the deployment of wiper malware, distributed denial-of-service (DDoS) attacks, and data leaks targeting Ukrainian government and critical infrastructure organizations. It also warns of the possibility of collateral impact on other countries and sectors due to the interconnected nature of cyberspace.

Pulse ID: 66bb1e3da7fbd7cc90075dc5
Pulse Link: https://otx.alienvault.com/pulse/66bb1e3da7fbd7cc90075dc5
Pulse Author: AlienVault
Created: 2024-08-13 08:50:04

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CERTUA #CyberSecurity #DDoS #DoS #Government #InfoSec #Malware #Military #OTX #OpenThreatExchange #RAT #Russia #UK #Ukr #Ukraine #Ukrainian #VNC #bot #AlienVault

Vermin Hackers Resurface to Target Ukrainian Defense Forces with SPECTR Malware https://thecyberexpress.com/vermin-hackers-resurface-target-ukraine-forces/ #UkrainianDefenseForces #TheCyberExpressNews #CybersecurityNews #CyberEssentials #TheCyberExpress #FirewallDaily #SpearPhishing #SPECTRMalware #VerminHackers #CyberWarfare #Espionage #Syncthing #Phishing #CERTUA #SPECTR

Russian Hackers Use Legit Remote Monitoring Software to Spy on Ukraine and Allies https://thecyberexpress.com/remote-monitoring-software-to-spy-on-ukraine/ #RemoteManagementSoftware #TheCyberExpressNews #CybersecurityNews #RemoteMonitoring #UkraineandAllies #TheCyberExpress #FirewallDaily #CyberWarfare #SmokeLoader #Hackers #malware #Ukraine #CERTUA #Europe #RMM #Spy #US

🇺🇦 Ukrainisches #CERT beschreibt Angriffe auf kritische Infrastruktur | Security https://www.heise.de/news/Ukrainisches-CERT-beschreibt-Angriffe-auf-kritische-Infrastruktur-9694865.html #CERTUA

Two CERT-UA articles in 24 hours: The Computer Emergency Response Team of Ukraine warns that the Russian APT Sandworm (publicly attributed Unit 74455 of the Russian Main Intelligence Directorate (GRU) by the U.S. government) was planning to disrupt about 20 organizations in Ukraine's energy, water and heat supply industry in March 2024. They identified several malware strains during incident response, including new LOADGRIP and BIASBOAT (Linux variant of QUEUESEED malware). CERT-UA described the various malware. IOC provided. 🔗 https://cert.gov.ua/article/6278706

#Sandworm #GRU #Russia #threatintel #cyberespionage #CERTUA #Ukraine #RussiaUkraineWar #IOC #UAC0133

The Computer Emergency Response Team of Ukraine (CERT-UA) reported an attempted cyberattack against a Defense Forces of Ukraine representative. An unidentified threat actor (tracked as UAC-0149) used Signal messenger to send a malicious RAR archive for a job application. This leveraged the vulnerability CVE-2023-38831 (7.8 high, disclosed 23 August 2023 by Group-IB as an exploited zero-day; RARLAB WinRAR Code Execution Vulnerability). CERT-UA explained that the infection chain leads to COOKBOX malware being deployed. IOC provided. 🔗 https://cert.gov.ua/article/6278620

#threatintel #cyberespionage #CERTUA #Ukraine #RussiaUkraineWar #IOC #UAC0149 #CVE_2023_38831

The Computer Emergency Response Team of Ukraine (CERT-UA) reports that the threat actor group UAC-0184 is increasingly using popular messengers and social engineering in 2024 to target the Ukrainian military, and steal documents/messenger data (e.g. Signal). Malware delivered include IDAT, RemcosRAT, VIOTTOKEYLOGGER, XWorm, SIGTOP and TUSC. A lot of IOC provided, and images depict infection chains or lure messages. 🔗 (Ukrainian language) https://cert.gov.ua/article/6278521

#CERTUA #UAC0184 #Ukraine #cyberespionage #threatintel #IOC #RemcosRAT #IDAT #xworm

The State Cyber Protection Centre of the State Service of Special Communications and Information Protection of Ukraine (SCPC SSSCIP), in collaboration with Unit 42, has a whopping 94 page malware analysis report (complete with IOC) on Smoke Loader malware (aka Dofoil or Sharik), used in a surge of recent attacks on Ukrainian financial institutions and government organizations. Ukraine’s CERT-UA first identified Smoke Loader used by the financially motivated threat group UAC-0006 on 05 May 2023. Since then, Smoke Loader has been used worldwide and also in ransomware attacks. 🔗 https://scpc.gov.ua/en/articles/356

#SmokeLoader #malware #threatintel #UAC0006 #Ukraine #SCPC #SSSCIP #Ukraine #CERTUA #IOC

UAC-0027 Attack Detection: Hackers Target Ukrainian Organizations Using DIRTYMOE (PURPLEFOX) Malware – Source: socprime.com https://ciso2ciso.com/uac-0027-attack-detection-hackers-target-ukrainian-organizations-using-dirtymoe-purplefox-malware-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #Cyberattack #socprimecom #socprime #CERT-UA #Malware #CERTUA #Sigma #Blog

APT28 Adversary Activity Detection: New Phishing Attacks Targeting Ukrainian and Polish Organizations – Source: socprime.com https://ciso2ciso.com/apt28-adversary-activity-detection-new-phishing-attacks-targeting-ukrainian-and-polish-organizations-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #Cyberattack #socprimecom #socprime #CERT-UA #CERTUA #Sigma #Blog #APT

New Phishing Campaign by UAC-0050: Kyivstar & Security Service of Ukraine Baits to Deliver Remcos RAT – Source: socprime.com https://ciso2ciso.com/new-phishing-campaign-by-uac-0050-kyivstar-security-service-of-ukraine-baits-to-deliver-remcos-rat-source-socprime-com/ #ThreatDetectionMarketplace #rssfeedpostgeneratorecho #ThreatHuntingContent #CyberSecurityNews #DetectionContent #SOCPrimePlatform #Latestthreats #Cyberattack #socprimecom #socprime #CERT-UA #Malware #CERTUA #Sigma #Blog

#UAC0050 launches another tricky #phishing campaign against Ukraine impersonating the email sender as the Security Service of Ukraine and spreading #Remcos #RAT, as #CERTUA reports. Detect attacks with relevant #Sigma rules from SOC Prime Platform.

https://socprime.com/blog/remcos-rat-detection-uac-0050-hackers-launch-phishing-attacks-impersonating-the-security-service-of-ukraine/

Good day all! The Computer Emergency Response Team of Ukraine, CERT-UA reports on a targeted attack attributed to #APT28 they observed on critical energy infrastructure facility in Ukraine. It started with a #phishing email that contained a link to an archive that led to a downloaded zip file that contained three decoy JPGs and a bat file that would run on the victims computer. The BAT file would, again, open some decoy web pages, but more importantly would create a .bat and .vbs file. There was some discovery commands issued, TOR program downloaded and hidden on the victim's computer as a hidden service, and abused common ports (445,389,3389,443). Last but not least, a PowerShell script was used to collect the password hash of the account. Enjoy and Happy Hunting!

https://cert.gov.ua/article/5702579

#CyberSecurity #ITSecurity #InfoSec #BlueTeam #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday #CERTUA

#APT28 resurfaces to set eyes on the Ukrainian power industry sector. #CERTUA warns defenders of a new #phishing attack abusing Microsoft Edge downloader, #TOR, #Mockbin, and #LOLBins. Detect adversary activity with #Sigma rules from SOC Prime Platform.

https://socprime.com/blog/apt28-phishing-attack-detection-hackers-target-ukrainian-energy-sector-using-microsoft-edge-downloader-tor-software-and-the-mockbin-service-for-remote-management/

#UAC0057 sets eyes on Ukraine exploiting #WinRAR #zeroday #vulnerability (СVE-2023-38831) to spread #PicassoLoader and #CobaltStrike Beacon, as #CERTUA reports. Proactively detect #cyberattacks with #SigmaRules from SOC Prime Platform.

https://socprime.com/blog/cve-2023-38831-detection-uac-0057-group-exploits-a-winrar-zero-day-to-spread-a-picassoloader-variant-and-cobaltstrike-beacon-via-rabbit-algorithm/ #CVE #malware

#Microsoft and #CERTUA (Ukraine's #CERT) warn of new attacks by #Turla, a Russian-state sponsored #hacking group that is targeting #Ukrainian & Eastern #European defence-sector targets.

The attack relies on laced Excel documents with macros that when activated executes a #PowerShell command that creates a scheduled task that impersonates a #Firefox browser updater. In reality, this task downloads the #DeliveryCheck #backdoor which connects to a #C2 server to receive further commands & #malware payloads.

What made the #DeliveryCheck backdoor stand out was that it comes with a server-side component that makes an infected #MicrosoftExchange server becoming a #C2 server for the threat actors as well.

#infosec #cybersecurity #cyberespionage #threatintel

https://www.bleepingcomputer.com/news/security/microsoft-hackers-turn-exchange-servers-into-malware-control-centers/