Listen to this Post
Over the past two weeks, Russian hacker groups have maintained low activity, focusing primarily on infiltrating Ukrainian state agencies, military situational awareness systems, and officials’ personal accounts. The most common attack vectors include phishing emails, messaging apps (Signal, WhatsApp, Telegram), infected USB drives, and compromised software images.
Key Malware Families in Circulation:
- DarkTortilla
- IDAT Loader
- MassLogger
- QuasarRAT
- Remcos RAT
- Vidar
- XWorm
Russian intelligence services are also actively purchasing Ukrainian Instagram accounts (especially those linked to i.ua and ukr.net emails) for disinformation and malware distribution.
The FSB’s UAC-0036/Callisto Group and LOSTKEYS Malware
The group deploys LOSTKEYS, a new malware targeting high-ranking officials, journalists, NGOs, and companies supporting Ukraine. The attack follows a multi-stage ClickFix tactic:
1. A decoy site with fake CAPTCHA is created.
2. During CAPTCHA verification, a PowerShell script is copied to the victim’s clipboard.
3. The script, once executed, downloads additional malware components.
You Should Know:
Detecting and Mitigating These Threats
1. Phishing & Malware Prevention:
Check for suspicious processes in Linux ps aux | grep -E 'DarkTortilla|IDAT|MassLogger|Quasar|Remcos|Vidar|XWorm' Monitor network connections netstat -tulnp | grep -E '(rat|loader|tortilla)'
2. Analyzing PowerShell Scripts:
Log PowerShell execution (Windows)
Enable-PSRemoting -Force
Set-ExecutionPolicy RemoteSigned
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object {$_.ID -eq "4104"}
3. Securing USB Devices:
Disable USB storage in Linux echo 'install usb-storage /bin/false' > /etc/modprobe.d/disable-usb-storage.conf
4. Darknet & Credential Monitoring:
Check leaked credentials (Linux) grep -r "ukr.net|i.ua" /var/log/
ICC’s Expanded Cybercrime Jurisdiction
The International Criminal Court is proposing amendments to the Rome Statute to include cybercrimes, particularly in response to Russian cyberattacks on Ukraine and EU nations.
What Undercode Say:
The cyberwarfare landscape is evolving, with Russia shifting focus toward EU political interference (e.g., Poland’s elections). Key takeaways:
– Defenders must prioritize:
– Enhanced email filtering (e.g., ClamAV).
– Behavioral analysis of PowerShell scripts.
– USB device restrictions.
– Threat actors are adapting:
– More targeted attacks (LOSTKEYS).
– Abuse of social media (Instagram).
– Legal frameworks are catching up:
– ICC’s cybercrime policy may redefine accountability.
Expected Output:
1. Monitor for: DarkTortilla, QuasarRAT, XWorm. 2. Block suspicious PowerShell executions. 3. Disable USB auto-mounting. 4. Audit leaked credentials (i.ua, ukr.net).
Prediction:
Russian cyber operations will escalate ahead of EU elections, with increased disinformation campaigns and destructive attacks on critical infrastructure.
(No non-cyber/IT URLs or irrelevant content found in the original post.)
References:
Reported By: Serhii Demediuk – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
