In a concerning development, Ukrainian and Polish authorities have become the primary targets of a threat actor that deploys Trojan-laced phishing emails. The malicious campaign has caught the attention of cybersecurity experts, who have named the group behind the attacks UAC-0050. This article delves into the attribution of the phishing wave and explores the techniques employed by this hacking group. It also sheds light on the common payload used in these campaigns – the RemcosRAT – and provides insight into the group’s repeated targeting of government entities.
Phishing Wave Attribution
The Computer Emergency Response Team of Ukraine (CERT-UA) has been actively monitoring and tracking the activities of various threat actors. In the case of the recent phishing wave, the team identified the culprit responsible for the attacks as UAC-0050. This attribution allows cybersecurity professionals to better understand the motivations and techniques behind the group’s actions.
Previous malicious campaign
Prior to the current phishing wave, UAC-0050 was involved in another malicious campaign. In this previous attack, the hackers distributed phishing emails with the subject line “Subpoenas to Court.” By capitalizing on the urgency and authority associated with legal proceedings, the threat actor increased the likelihood of unsuspecting recipients opening the malicious attachments.
Commonalities in campaigns
One striking similarity across both the previous and current campaigns is the consistent use of the RemcosRAT as the payload in the phishing emails. RAT stands for Remote Access Trojan, indicating that this malware allows threat actors unauthorized access to compromised systems. The RemcosRAT has become a popular tool in various malicious campaigns due to its capabilities for remotely managing Windows systems.
Use of compromised accounts
In both the previous and current campaigns, UAC-0050 leveraged compromised legitimate accounts to transmit the phishing emails. This tactic adds an extra layer of legitimacy to the communications and increases the chances of victims falling for the scam. By hijacking trusted accounts, the threat actors exploit the inherent trust associated with those individuals or organizations.
Evasion tactics
To evade detection, UAC-0050 has employed the use of a program obfuscator called SmartAssembly. Obfuscation is a technique used to make the code or behavior of malware difficult to understand or analyze. By implementing SmartAssembly, the threat actors make it challenging for security systems to identify the malicious nature of the attachments.
Remcos RAT
The RemcosRAT, although marketed as legitimate software for remotely managing Windows systems, has unfortunately found popularity among threat actors. Its features for remote access and control make it an ideal tool for cybercriminals to exploit compromised systems and gather sensitive information.
Recognition as the top malware strain
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified RemcosRAT as one of the top malware strains of 2021. This recognition highlights the severity of the threat posed by the software and emphasizes the urgent need for enhanced cybersecurity measures to counter its spread.
Repeat offender
Remarkably, this is the third observed phishing campaign attributed to UAC-0050 in the span of just one month. The group’s persistence and relentless targeting of various entities, particularly government agencies, raises concerns about the effectiveness of current cybersecurity measures.
Past targeting of Ukrainian government agencies
In a previous incident, UAC-0050 targeted Ukrainian government agencies using the same Remcos surveillance tool disguised as official requests. The threat actor capitalized on the trust placed in official communication to successfully deceive victims. These actions underscore the urgent need for robust cybersecurity protocols within government institutions.
The ongoing phishing campaigns targeting Ukrainian and Polish authorities by UAC-0050 serve as a stark reminder of the ever-evolving threat landscape. With the sophisticated use of Trojan-laced phishing emails and the deployment of the RemcosRAT payload, this threat actor poses a significant risk to organizations and individuals alike. It is imperative that cybersecurity practices continue to evolve to counter these threats effectively. By staying vigilant and employing robust security measures, we can mitigate the risks associated with these malicious campaigns and protect critical systems and data from falling into the wrong hands.