Criminal Gang Impersonates Russian Government in Phishing Campaign
Researchers at IBM Security X-Force are tracking a financially motivated cybercriminal group called “Hive0117” that’s impersonating a Russian government agency to target users in Eastern Europe.
“The campaign masquerades as official communications from the Russian Government’s Federal Bailiffs Service, the Russian-language emails are addressed to users in Lithuania, Estonia, and Russia in the Telecommunications, Electronic and Industrial sectors,” the researchers write. “The activity predates and is not believed to be associated with the Russian-led invasion of Ukraine.”
The phishing emails contain a malicious zip file that will install the DarkWatchman remote access Trojan. The emails attempt to convince the user to download and open this file.
“The contents of the emails feature identical Russian-language text detailing several articles related to enforcement procedures associated with the Kuntsevsky District Court of Moscow, upheld by the ‘Bailiff of the Interdistrict Department of Bailiffs for the Execution of Decisions of the Tax Authorities,’” the researchers write. “The only variation observed by X-Force within the emails is in the name and ‘case number’ associated with the individual email and accompanying malicious ZIP archive file attachment.”
The researchers note that some of the emails were specifically sent to high-ranking employees at the targeted companies.
“X-Force discovered multiple emails that were sent in mid-February 2022 to individual users, including a state-owned communication company based in Lithuania, a prominent Industrial Enterprise in Estonia, and several electronic and telecommunication businesses located in Russia,” the researchers write. “In some cases, the emails were targeting company owners, as well as individuals in leadership positions associated with Dispatch Services and Sales. Targeted organizations could be of high value to criminal actors given the targets’ potential trusted access to a wide and distributed client base.”
New-school security awareness training can teach your employees how to recognize phishing and other social engineering attacks.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW