Tuesday, July 23, 2024

ACTINIUM Hackers Group Targeting Government, Military, NGO to Steal Sensitive Data

Microsoft has recently announced that a cybersecurity hacking group that is known as Gamaredon is creating a streak of spear-phishing emails. 

But, in the recent event, it has been detected that the operators of the ACTINIUM hacker group are targeting the following Ukrainian sectors to steal sensitive data:-

  • Government
  • Military
  • NGO
  • Judiciary
  • Law enforcement

This threat group is continuously targetting Ukrainian entities and all other organizations that are associated with Ukraine. And the hacker group has been initiating such attacks since October 2021.

Not only this, after a proper investigation, the Microsoft Threat Intelligence Centre has also remarked that this attacking group has been tracked as Armageddon and ACTINIUM.

Binaries Deployed

However, cybersecurity experts have used different ways to track down the attack during an investigation. 

In order to track those attacks, the operators have embedded a tracking pixel-like Web dug that framed which binaries have been deployed in this attack; that’s why we have mentioned the binaries below:-

  • PowerPunch
  • Pterodo
  • Quietsieve

Stagers & downloaders

Moreover, to support the payload staging and its C2 infrastructure, Microsoft has identified more than 25 unique domains and over 80 unique IP addresses that are used by the operators of the ACTINIUM hacker group.

In this cybersecurity attack, the security researchers have detected six stagers and downloaders that we have mentioned below:-

  • DinoTrain
  • DilongTrash
  • Obfuberry
  • PowerPunch
  • DessertDown
  • Obfumerry

In January SSU blocked 120 cyberattacks 

Apart from Microsoft, Palo Alto Networks Unit 42 has also detected this attack group issue. However, the experts from Palo claimed that they noticed the threat actors trying to negotiate a western government entity in Ukraine, and all this was glimpsed on 19 January 2022.

All this has been triggered by the threat actors through a spear-phishing attack, in which they have been pushing a malware downloader.

However, in this, the threat actors are not emailing the downloader, rather than the threat actors leveraged job tracking and employment services within Ukraine.

Apart from this, the cybersecurity analysts of Symantec’s Threat Hunter team have also noticed the threat group Gamaredon that is distributing macro-laced word documents in the spear-phishing attacks.

While apart from this, there are some security alerts that will surely help the users to identify such attacks, and here they are mentioned below:-

  • Suspicious script execution.
  • Suspicious dynamic link library loaded.
  • Suspicious screen capture activity.
  • Staging of sensitive data.
  • An anomalous process is executing the encoded command.

This kind of threat alert can be triggered by unrelated threat activity, and that’s why it’s very necessary to stay alert.

Not only this, but the Microsoft Threat Intelligence Center has also stated:-

“The threat actors are targeting military, non-government organizations (NGOs), judiciary, law enforcement, and non-profit organizations.”

The main motive of the threat actors is to exfiltrate all the sensitive information to maintain access so that they can hijack the system and use it as per their requirements.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles