The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against critical Ukrainian infrastructure, including government agencies, key industries, and military entities.
Phishing emails promoting integration with Amazon, Microsoft, and ZTA contained malicious .rdp files.
Upon opening, these files connected devices to attacker-controlled servers, compromising security.
The sophisticated attack leveraged a compromised connection to gain unauthorized access to a wide range of local resources, including sensitive systems and devices, potentially posing a serious threat to Ukraine’s critical infrastructure.
Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo
A large-scale phishing campaign was detected in late October 2024, likely initiated in August 2024. Multiple global cybersecurity organizations confirmed that this international threat poses a significant risk to individual entities and national security.
The threat actor, UAC-0215, is conducting a high-risk phishing campaign. The campaign aims to target critical infrastructure in Ukraine, including government agencies, manufacturers, and military organizations.
The campaign uses malicious RDP techniques to compromise systems and possibly exfiltrate sensitive data, which poses a significant threat to Ukraine’s national security.
UAC-0215 deployed a phishing campaign using malicious RDP files disguised as legitimate documents. When opened, these files allowed unauthorized access to critical Ukrainian systems, potentially compromising sensitive information and disrupting operations.
Opening a malicious .rdp file connects the victim’s device to an attacker’s server, granting unauthorized access to sensitive system resources, which enables the attacker to execute malicious code, potentially compromising the entire system.
It poses a significant threat, expanding its target scope beyond Ukraine. This heightened risk, coupled with recent cyberattacks on Ukraine, underscores the potential for widespread cyberattacks across various regions.
Phishing campaigns targeting Ukraine exploited RDP vulnerabilities to compromise critical systems in the public and industrial sectors, potentially exposing sensitive information and disrupting operations.
To safeguard against UAC-0215, organizations should enhance mail gateway filtering to block .rdp files and restrict user execution privileges for these file types, mitigating the risk of malicious configurations and unauthorized access.
To mitigate RDP risks, users can implement a Group Policy to disable resource redirection in RDP sessions and configure firewall rules to block outbound connections from mstsc.exe to external IP addresses. This will prevent unauthorized remote access and reduce potential exploits.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!
