Thursday, March 28, 2024

ACTINIUM Hackers Group Targeting Government, Military, NGO to Steal Sensitive Data

Microsoft has recently announced that a cybersecurity hacking group that is known as Gamaredon is creating a streak of spear-phishing emails. 

But, in the recent event, it has been detected that the operators of the ACTINIUM hacker group are targeting the following Ukrainian sectors to steal sensitive data:-

  • Government
  • Military
  • NGO
  • Judiciary
  • Law enforcement

This threat group is continuously targetting Ukrainian entities and all other organizations that are associated with Ukraine. And the hacker group has been initiating such attacks since October 2021.

Not only this, after a proper investigation, the Microsoft Threat Intelligence Centre has also remarked that this attacking group has been tracked as Armageddon and ACTINIUM.

Binaries Deployed

However, cybersecurity experts have used different ways to track down the attack during an investigation. 

In order to track those attacks, the operators have embedded a tracking pixel-like Web dug that framed which binaries have been deployed in this attack; that’s why we have mentioned the binaries below:-

  • PowerPunch
  • Pterodo
  • Quietsieve

Stagers & downloaders

Moreover, to support the payload staging and its C2 infrastructure, Microsoft has identified more than 25 unique domains and over 80 unique IP addresses that are used by the operators of the ACTINIUM hacker group.

In this cybersecurity attack, the security researchers have detected six stagers and downloaders that we have mentioned below:-

  • DinoTrain
  • DilongTrash
  • Obfuberry
  • PowerPunch
  • DessertDown
  • Obfumerry

In January SSU blocked 120 cyberattacks 

Apart from Microsoft, Palo Alto Networks Unit 42 has also detected this attack group issue. However, the experts from Palo claimed that they noticed the threat actors trying to negotiate a western government entity in Ukraine, and all this was glimpsed on 19 January 2022.

All this has been triggered by the threat actors through a spear-phishing attack, in which they have been pushing a malware downloader.

However, in this, the threat actors are not emailing the downloader, rather than the threat actors leveraged job tracking and employment services within Ukraine.

Apart from this, the cybersecurity analysts of Symantec’s Threat Hunter team have also noticed the threat group Gamaredon that is distributing macro-laced word documents in the spear-phishing attacks.

While apart from this, there are some security alerts that will surely help the users to identify such attacks, and here they are mentioned below:-

  • Suspicious script execution.
  • Suspicious dynamic link library loaded.
  • Suspicious screen capture activity.
  • Staging of sensitive data.
  • An anomalous process is executing the encoded command.

This kind of threat alert can be triggered by unrelated threat activity, and that’s why it’s very necessary to stay alert.

Not only this, but the Microsoft Threat Intelligence Center has also stated:-

“The threat actors are targeting military, non-government organizations (NGOs), judiciary, law enforcement, and non-profit organizations.”

The main motive of the threat actors is to exfiltrate all the sensitive information to maintain access so that they can hijack the system and use it as per their requirements.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles