Written by AJ Vicens
Mar 8, 2022 | CYBERSCOOP
Hackers believed to be associated with the governments of Russia, Belarus and China are targeting Ukraine, Poland and European governments, researchers say, ranging from espionage attempts to phishing campaigns and coinciding with the intensification of the Russian assault on Ukraine.
Shane Huntley, the director of Google’s Threat Analysis Group (TAG), said in a blog post Monday that the group has observed well-known Russian military hacking group Fancy Bear (also known as APT28) conducting several large credential phishing campaigns targeting UkrNet, a Ukrainian media company. Two recent campaigns, he said, involved newly created Blogspot domains as initial landing pages, which then redirected targets to credential phishing pages.
TAG also observed a hacking operation known as Ghostwriter, or UNC1151, running credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations.
Ghostwriter refers to activity believed to be operating out of Belarus, researchers with cybersecurity firm Mandiant reported in November.
Separately, Ukraine’s Computer Emergency Response Team published details Monday about ongoing UNC1151 targeting of Ukrainian information sources with MicroBackdoor malware. That malware creates a backdoor, but also takes screenshots on target machines.
Google further said Monday that TAG