Wednesday, April 17, 2024

ACTINIUM Hackers Group Targeting Government, Military, NGO to Steal Sensitive Data

Microsoft has recently announced that a cybersecurity hacking group that is known as Gamaredon is creating a streak of spear-phishing emails. 

But, in the recent event, it has been detected that the operators of the ACTINIUM hacker group are targeting the following Ukrainian sectors to steal sensitive data:-

  • Government
  • Military
  • NGO
  • Judiciary
  • Law enforcement

This threat group is continuously targetting Ukrainian entities and all other organizations that are associated with Ukraine. And the hacker group has been initiating such attacks since October 2021.

Not only this, after a proper investigation, the Microsoft Threat Intelligence Centre has also remarked that this attacking group has been tracked as Armageddon and ACTINIUM.

Binaries Deployed

However, cybersecurity experts have used different ways to track down the attack during an investigation. 

In order to track those attacks, the operators have embedded a tracking pixel-like Web dug that framed which binaries have been deployed in this attack; that’s why we have mentioned the binaries below:-

  • PowerPunch
  • Pterodo
  • Quietsieve

Stagers & downloaders

Moreover, to support the payload staging and its C2 infrastructure, Microsoft has identified more than 25 unique domains and over 80 unique IP addresses that are used by the operators of the ACTINIUM hacker group.

In this cybersecurity attack, the security researchers have detected six stagers and downloaders that we have mentioned below:-

  • DinoTrain
  • DilongTrash
  • Obfuberry
  • PowerPunch
  • DessertDown
  • Obfumerry

In January SSU blocked 120 cyberattacks 

Apart from Microsoft, Palo Alto Networks Unit 42 has also detected this attack group issue. However, the experts from Palo claimed that they noticed the threat actors trying to negotiate a western government entity in Ukraine, and all this was glimpsed on 19 January 2022.

All this has been triggered by the threat actors through a spear-phishing attack, in which they have been pushing a malware downloader.

However, in this, the threat actors are not emailing the downloader, rather than the threat actors leveraged job tracking and employment services within Ukraine.

Apart from this, the cybersecurity analysts of Symantec’s Threat Hunter team have also noticed the threat group Gamaredon that is distributing macro-laced word documents in the spear-phishing attacks.

While apart from this, there are some security alerts that will surely help the users to identify such attacks, and here they are mentioned below:-

  • Suspicious script execution.
  • Suspicious dynamic link library loaded.
  • Suspicious screen capture activity.
  • Staging of sensitive data.
  • An anomalous process is executing the encoded command.

This kind of threat alert can be triggered by unrelated threat activity, and that’s why it’s very necessary to stay alert.

Not only this, but the Microsoft Threat Intelligence Center has also stated:-

“The threat actors are targeting military, non-government organizations (NGOs), judiciary, law enforcement, and non-profit organizations.”

The main motive of the threat actors is to exfiltrate all the sensitive information to maintain access so that they can hijack the system and use it as per their requirements.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

Hackers target Apple device users because they are perceived to be of higher social...

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles