SSSCIP: Hackers attack Ukrainian telecom operators and service providers
State Service of Special Communications and Information Protection,
posted
25 June 2022
13:52
The Computer Emergency Response Team of Ukraine (CERT-UA) under the SSSCIP informs of dangerous bulk mail titled “Free legal assistance.” The mails come from an (apparently compromised) address in the gov.ua domain and contain a password-protected attachment “Алгоритм дій членів сім’ї безвісти відсутнього військовослужбовця (Algorithm for family members of MIA soldiers) LegalAid.rar.”
This RAR archive contains a document file “Алгоритм_LegalAid.xlsm,” opening which will eventually result in downloading and starting of the DarkCrystal RAT malware.
Considering known recipient addresses, our experts believe this attack is targeted at Ukrainian telecom operators and telecom service providers.
This activity is tracked by UAC-0113. The same criminals already launched a cyber-attack on Ukrainian media organizations in June.