This huge Russian phishing campaign is hitting targets across the world
Russian state-sponsored group is ramping up its phishing efforts
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurity researchers have observed a significant uptick in Russianphishingcampaigns targeting government agencies and other organizations in the West.
In anew research report, Proofpoint said that it spotted APT28, AKA Fancy Bear, distributing a larger amount of malicious emails to targets across Europe and North America.
The campaign started in March 2023 and resulted in tens of thousands of phishing emails sent to organizations in government, aerospace, education, finance, manufacturing, and technology sectors.
Outlook and WinRAR
US intelligence puts Fancy Bear under the direct command of the Russian General Staff Main Intelligence Directorate (GRU).
These emails carry either malicious files, or links, and try to exploit multiple vulnerabilities that the cybersecurity community discovered, and patched, months ago. This means that Fancy Bear is after organizations that aren’t that diligent when it comes to their systems and endpoints.
Proofpoint singles out two vulnerabilities - CVE-2023-23397, which is an elevation of privilege flaw found inMicrosoftOutlook, and CVE-2023-38831, a remote code execution flaw discovered recently in WinRAR. While the former allows ATP28 to exploit TNEF files and grab a hash of the target’s NTLM password, the latter allows for the execution of “arbitrary code when a user attempts to view a benign file within a ZIP archive.”
While the campaign’s goal is debatable, it’s most likely to gather intelligence. This could be particularly damaging if the campaign is successful in the government, aerospace, and technology sectors.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The last time we heard of APT28 was in late spring 2023 year when the group was targeting Ukrainian government employees with information-stealingmalwareby posing as IT staff working in these institutions. After successfully contacting their targets, the hackers would talk them into running a PowerShell command which would download information-stealing malware.
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Dangerous Android banking malware looks to trick victims with fake money transfers
Sophos Firewall hack on government network used an all-new custom malware
Don’t wait until Black Friday, this year’s best Nintendo Switch bundles are on sale now
