Russian hacking group targets Roundcube servers to spy on government institutions and military entities in Ukraine

A new report from threat intelligence firm Recorded Future highlights how a Russian hacking group is using Roundcube server infections to carry out reconnaissance and exfiltration operations on government institutions and military entities in Ukraine. This latest revelation is just one part of a broader hacking and disinformation campaign that Russia has been waging against Ukraine since it annexed Crimea in 2014.

Advisory from Recorded Future

According to an advisory from Recorded Future, the Roundcube server infections are being used to run reconnaissance and exfiltration scripts. This enables the hackers to redirect incoming emails and gather session cookies, user information, and address books. The collected information is then used for spying on government institutions and military entities in Ukraine. The group is using these tactics to evade detection and cover its tracks.

Collaboration with CERT-UA

Recorded Future has been working closely with Ukraine’s Computer Emergency Response Team (CERT-UA) to document this activity, which is being attributed to Russia’s GRU military spy unit. The collaboration has allowed researchers to gain a deep understanding of the group’s activities and tactics. CERT-UA has also been able to spread awareness about this threat among Ukrainian organizations.

Spear-phishing Campaign Tactics

The spear-phishing campaign used by the hacking group involved sending emails to individuals in government institutions and military entities in Ukraine. The emails contained attachments that were designed to compromise vulnerable Roundcube servers. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open the attachments.

These spear-phishing emails contained news themes that related to Ukraine, with subject lines and content mirroring legitimate media sources. The group uses these tactics to make the emails look and feel official, increasing the likelihood of the recipient opening the attachment.

Operations of GRU-linked Group

The GRU-linked group responsible for these attacks has been operational since at least November 2020. They have previously been blamed for using zero-day flaws in Microsoft’s flagship Outlook software. The group is focused on digitally spying on entities in Ukraine and across Europe, primarily among government, military, and defense organizations. The group’s success in obtaining sensitive information has allowed the Russian government to enhance its capabilities in many of these areas.

Recommended Defense Mechanisms

Recorded Future has documented the activity of this hacking group and recommended several measures that organizations can implement to prevent and detect malicious activity from malicious domains. These measures include configuring intrusion detection systems (IDS), intrusion prevention systems (IPS), or network defense mechanisms to identify malicious activity coming from malicious domains.

Organizations can also disable HTML and/or JavaScript within email attachments, and filter incoming email traffic using anti-spoofing and authentication mechanisms such as SPF or DKIM, which check the validity of the sender’s records. These steps are essential to ensure that organizations can detect and prevent malicious activities.

A broader Russian hacking and disinformation campaign

This spear-phishing campaign is just one example of the broader hacking and disinformation campaign that Russia has been waging against Ukraine since it annexed Crimea in 2014. The campaign has been multifaceted, with a broad range of activities and tactics used by Russian actors. The use of cyberattacks has allowed Russian actors greater access and insight into the Ukrainian government and military, which has allowed them to develop and refine their strategy over time.

The report shows the sophisticated nature of the Russian hacking group’s activities, targeting Roundcube servers in Ukraine. The use of spear-phishing campaigns to exploit vulnerable individuals and organizations and gain access to sensitive data highlights the need for organizations to remain vigilant and implement robust security measures. The recommendations from Recorded Future underline the importance of defense mechanisms that can help identify and contain these types of threats. The situation underscores the importance of necessary agency and government-level measures to prevent and respond to cyber threats.

Explore more

Can Federal Lands Power the Future of AI Infrastructure?

I’m thrilled to sit down with Dominic Jainy, an esteemed IT professional whose deep knowledge of artificial intelligence, machine learning, and blockchain offers a unique perspective on the intersection of technology and federal policy. Today, we’re diving into the US Department of Energy’s ambitious plan to develop a data center at the Savannah River Site in South Carolina. Our conversation

Can Your Mouse Secretly Eavesdrop on Conversations?

In an age where technology permeates every aspect of daily life, the notion that a seemingly harmless device like a computer mouse could pose a privacy threat is startling, raising urgent questions about the security of modern hardware. Picture a high-end optical mouse, designed for precision in gaming or design work, sitting quietly on a desk. What if this device,

Building the Case for EDI in Dynamics 365 Efficiency

In today’s fast-paced business environment, organizations leveraging Microsoft Dynamics 365 Finance & Supply Chain Management (F&SCM) are increasingly faced with the challenge of optimizing their operations to stay competitive, especially when manual processes slow down critical workflows like order processing and invoicing, which can severely impact efficiency. The inefficiencies stemming from outdated methods not only drain resources but also risk

Structured Data Boosts AI Snippets and Search Visibility

In the fast-paced digital arena where search engines are increasingly powered by artificial intelligence, standing out amidst the vast online content is a formidable challenge for any website. AI-driven systems like ChatGPT, Perplexity, and Google AI Mode are redefining how information is retrieved and presented to users, moving beyond traditional keyword searches to dynamic, conversational summaries. At the heart of

How Is Oracle Boosting Cloud Power with AMD and Nvidia?

In an era where artificial intelligence is reshaping industries at an unprecedented pace, the demand for robust cloud infrastructure has never been more critical, and Oracle is stepping up to meet this challenge head-on with strategic alliances that promise to redefine its position in the market. As enterprises increasingly rely on AI-driven solutions for everything from data analytics to generative