ACTINIUM Hackers Group Targeting Government, Military, NGO to Steal Sensitive Data

Microsoft has recently announced that a cybersecurity hacking group that is known as Gamaredon is creating a streak of spear-phishing emails. 

But, in the recent event, it has been detected that the operators of the ACTINIUM hacker group are targeting the following Ukrainian sectors to steal sensitive data:-

• Government
• Military
• NGO
• Judiciary
• Law enforcement

This threat group is continuously targetting Ukrainian entities and all other organizations that are associated with Ukraine. And the hacker group has been initiating such attacks since October 2021.

Not only this, after a proper investigation, the Microsoft Threat Intelligence Centre has also remarked that this attacking group has been tracked as Armageddon and ACTINIUM.

Binaries Deployed

However, cybersecurity experts have used different ways to track down the attack during an investigation. 

In order to track those attacks, the operators have embedded a tracking pixel-like Web dug that framed which binaries have been deployed in this attack; that’s why we have mentioned the binaries below:-

• PowerPunch
• Pterodo
• Quietsieve

Stagers & downloaders

Moreover, to support the payload staging and its C2 infrastructure, Microsoft has identified more than 25 unique domains and over 80 unique IP addresses that are used by the operators of the ACTINIUM hacker group.

In this cybersecurity attack, the security researchers have detected six stagers and downloaders that we have mentioned below:-

• DinoTrain
• DilongTrash
• Obfuberry
• PowerPunch
• DessertDown
• Obfumerry

In January SSU blocked 120 cyberattacks

Apart from Microsoft, Palo Alto Networks Unit 42 has also detected this attack group issue. However, the experts from Palo claimed that they noticed the threat actors trying to negotiate a western government entity in Ukraine, and all this was glimpsed on 19 January 2022.

All this has been triggered by the threat actors through a spear-phishing attack, in which they have been pushing a malware downloader.

However, in this, the threat actors are not emailing the downloader, rather than the threat actors leveraged job tracking and employment services within Ukraine.

Apart from this, the cybersecurity analysts of Symantec’s Threat Hunter team have also noticed the threat group Gamaredon that is distributing macro-laced word documents in the spear-phishing attacks.

While apart from this, there are some security alerts that will surely help the users to identify such attacks, and here they are mentioned below:-

• Suspicious script execution.
• Suspicious dynamic link library loaded.
• Suspicious screen capture activity.
• Staging of sensitive data.
• An anomalous process is executing the encoded command.

This kind of threat alert can be triggered by unrelated threat activity, and that’s why it’s very necessary to stay alert.

Not only this, but the Microsoft Threat Intelligence Center has also stated:-

“The threat actors are targeting military, non-government organizations (NGOs), judiciary, law enforcement, and non-profit organizations.”

The main motive of the threat actors is to exfiltrate all the sensitive information to maintain access so that they can hijack the system and use it as per their requirements.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.