In its latest operation, UAC-0173 infected the targeted computers with DarkCrystal malware — a commercial Russian backdoor that appears to have been developed and maintained by a single person and sold predominantly on Russian underground forums since 2019. The hacking group, identified as UAC-0173, has been distributing phishing emails since mid-January, posing as regional offices of Ukraine’s Ministry of Justice, authorities said in a report released on Tuesday. Ukraine’s state cyber response team (CERT-UA) warned that hackers are targeting notaries' computers in an attempt to gain remote access and manipulate government registries. Since July, the hacker group tracked as UAC-0212 has targeted suppliers from Serbia, Czechia and Ukraine with various malware variants, such as EmpirePast, Spark and CrookBag. In the campaign against Ukrainian notaries, UAC-0173 also used various utilities to bypass security controls, scan networks, intercept authentication data, and steal credentials, the authorities said. Over the weekend, CERT-UA also warned of another threat actor targeting Ukrainian and foreign enterprises, including manufacturers and suppliers of automated systems used to monitor and control industrial processes. Earlier in December, suspected Russian military intelligence hackers breached the infrastructure of Ukraine’s state registers, which are managed by the Justice Ministry, disrupting services for several weeks. The likely goal of these attacks was to compromise the computer networks of service providers, with the aim of further using the obtained data to hack Ukraine's critical industrial enterprises, the cyber agency said. According to CERT-UA, the group is likely conducting the attacks for hire and receiving a financial reward from an unnamed source. Researchers said they identified affected computers in six regions and prevented unauthorized registry modifications, in some cases stopping attacks at their final stages. Over the past two months, the group has also attacked several Ukrainian enterprises specializing in the design and production of equipment for drying, transporting, and storing grain. It remains unclear whether the attack on state registries is linked to or was exploited by the UAC-0173 campaign against notaries. Researchers believe the group is linked to the notorious Russian threat actor Sandworm.
This Cyber News was published on therecord.media. Publication date: Wed, 26 Feb 2025 15:40:17 +0000