SSSCIP warns about new dangerous emails as cyberattack on Ukraine’s public institutions

The Computer Emergency Response Team of Ukraine (CERT-UA) under the SSSCIP warns about new dangerous emails titled “Specialized military and defense prosecutor’s office. Information about open vacancies and staffing” (English for “Спеціалізованої прокуратури у військовій та оборонній сфері. Інформація щодо наявності вакансій та їх укомплектування”). 

The emails contain an attachment in the form of an XLS file with a macros of which the activation results in the creation and execution of a write.exe file on the affected computer. 

Ultimately, the macros infects your device with the Cobalt Strike Beacon malware.

This activity is associated with the UAC-0056 group which has already been involved in cyberattacks on Ukraine in April and March. 

See details at: https://cert.gov.ua/article/619229