The latest cyber attack is one of the manifestations of Russia’s hybrid war against Ukraine, which has been going on since 2014. Russia’s cyber-troops are often working against the United States and Ukraine, trying to use technology to shake up the political situation. Moscow continues to wage a hybrid war and is actively building forces in the information and cyberspace. In a statement, they wrote:Īs of now, we can say that all the evidence points to the fact that Russia is behind the cyber attack.
Ukrainian officials said UNC1151 was likely working on behalf of Russia when it used its skill in harvesting credentials and infiltrating websites to deface Ukraine’s government sites. With control of content management systems belonging to news sites and other heavily trafficked properties, UNC1151 “primarily promoted anti-NATO narratives that appeared intended to undercut regional security cooperation in operations targeting Lithuania, Latvia, and Poland,” authors of the Mandiant report wrote. Ghostwriter worked by using phishing emails and theft domains that spoof legitimate websites such as Facebook to steal victim credentials. The group, which researchers at security firm Mandiant have linked to the government of Russian ally Belarus, was behind an influence campaign named Ghostwriter.
Over the weekend, Serhiy Demedyuk, deputy head of Ukraine’s National Security and Defense Council, told news outlets that preliminary findings from a joint investigation of several Ukrainian state agencies show that a threat actor group known as UNC1151 was likely behind the defacement hack. There are several reasons why this activity is inconsistent with cybercriminal ransomware activity observed by MSTIC.” “In reality, the ransomware note is a ruse and that the malware destructs MBR and the contents of the files it targets. “Overwriting the MBR is atypical for cybercriminal ransomware,” members of the Microsoft Threat Intelligence Center wrote in Saturday’s post.
0 kommentar(er)
