A new report from threat intelligence firm Recorded Future highlights how a Russian hacking group is using Roundcube server infections to carry out reconnaissance and exfiltration operations on government institutions and military entities in Ukraine. This latest revelation is just one part of a broader hacking and disinformation campaign that Russia has been waging against Ukraine since it annexed Crimea in 2014.
Advisory from Recorded Future
According to an advisory from Recorded Future, the Roundcube server infections are being used to run reconnaissance and exfiltration scripts. This enables the hackers to redirect incoming emails and gather session cookies, user information, and address books. The collected information is then used for spying on government institutions and military entities in Ukraine. The group is using these tactics to evade detection and cover its tracks.
Collaboration with CERT-UA
Recorded Future has been working closely with Ukraine’s Computer Emergency Response Team (CERT-UA) to document this activity, which is being attributed to Russia’s GRU military spy unit. The collaboration has allowed researchers to gain a deep understanding of the group’s activities and tactics. CERT-UA has also been able to spread awareness about this threat among Ukrainian organizations.
Spear-phishing Campaign Tactics
The spear-phishing campaign used by the hacking group involved sending emails to individuals in government institutions and military entities in Ukraine. The emails contained attachments that were designed to compromise vulnerable Roundcube servers. The campaign leveraged news about Russia’s war against Ukraine to encourage recipients to open the attachments.
These spear-phishing emails contained news themes that related to Ukraine, with subject lines and content mirroring legitimate media sources. The group uses these tactics to make the emails look and feel official, increasing the likelihood of the recipient opening the attachment.
Operations of GRU-linked Group
The GRU-linked group responsible for these attacks has been operational since at least November 2020. They have previously been blamed for using zero-day flaws in Microsoft’s flagship Outlook software. The group is focused on digitally spying on entities in Ukraine and across Europe, primarily among government, military, and defense organizations. The group’s success in obtaining sensitive information has allowed the Russian government to enhance its capabilities in many of these areas.
Recommended Defense Mechanisms
Recorded Future has documented the activity of this hacking group and recommended several measures that organizations can implement to prevent and detect malicious activity from malicious domains. These measures include configuring intrusion detection systems (IDS), intrusion prevention systems (IPS), or network defense mechanisms to identify malicious activity coming from malicious domains.
Organizations can also disable HTML and/or JavaScript within email attachments, and filter incoming email traffic using anti-spoofing and authentication mechanisms such as SPF or DKIM, which check the validity of the sender’s records. These steps are essential to ensure that organizations can detect and prevent malicious activities.
A broader Russian hacking and disinformation campaign
This spear-phishing campaign is just one example of the broader hacking and disinformation campaign that Russia has been waging against Ukraine since it annexed Crimea in 2014. The campaign has been multifaceted, with a broad range of activities and tactics used by Russian actors. The use of cyberattacks has allowed Russian actors greater access and insight into the Ukrainian government and military, which has allowed them to develop and refine their strategy over time.
The report shows the sophisticated nature of the Russian hacking group’s activities, targeting Roundcube servers in Ukraine. The use of spear-phishing campaigns to exploit vulnerable individuals and organizations and gain access to sensitive data highlights the need for organizations to remain vigilant and implement robust security measures. The recommendations from Recorded Future underline the importance of defense mechanisms that can help identify and contain these types of threats. The situation underscores the importance of necessary agency and government-level measures to prevent and respond to cyber threats.