Microsoft: Russian FSB hackers hitting Ukraine since October

Microsoft said today that a Russian hacking group known as Gamaredon has been behind a streak of spear-phishing emails targeting Ukrainian entities and organizations related to Ukrainian affairs since October 2021.

Linked by Ukraine’s security (SSU) and secret (SBU) services to Russia’s Federal Security Service (FSB), the country’s domestic intelligence service, this hacking group is also tracked as Armageddon, Primitive Bear, and ACTINIUM.

Gamaredon has been active for at least a decade and has been behind thousands of attacks on Ukrainian orgs since 2013.

Security and threat researchers with the Microsoft Threat Intelligence Center (MSTIC) and the Microsoft Digital Security Unit (DSU) said today that Gamaredon’s cyber-espionage campaign is being coordinated out of Crimea, confirming SSU’s assessment that the Gamaredon hackers are officers of the Crimean FSB who sided with Russia during the 2014 occupation.

“MSTIC has observed ACTINIUM targeting organizations in Ukraine spanning government, military, non-government organizations (NGO), judiciary, law enforcement, and non-profit, with the primary intent of exfiltrating sensitive information, maintaining access, and using acquired access to move laterally into related organizations,” Microsoft added.

“Since October 2021, ACTINIUM has targeted or compromised accounts at organizations critical to emergency response and ensuring the security of Ukrainian territory, as well as organizations that would be involved in coordinating the distribution of international and humanitarian aid to Ukraine in a crisis.”

Gamaredon is not linked to last month’s cyberattacks that targeted multiple Ukraine government agencies and corporate entities with destructive data-wiping malware disguised as ransomware.

SSU blocks 120 cyberattacks in January

Palo Alto Networks’ Unit 42 also issued a report regarding this group’s recent activity targeting Ukraine and mentioned “an attempt to compromise a Western government entity in Ukraine on Jan. 19, 2022,” via a spear-phishing attack pushing a malware downloader.

“In this attempt, rather than emailing the downloader directly to their target, the actors instead leveraged a job search and employment service within Ukraine,” Unit 42 said.

“Given the steps and precision delivery involved in this campaign, it appears this may have been a specific, deliberate attempt by Gamaredon to compromise this Western government organization.”

The same tactics were described by Symantec’s Threat Hunter team, who saw Gamaredon distributing macro-laced Word documents in spear-phishing attacks that started in July 2021.

These reports confirm an advisory published by the Ukrainian Computer Emergency Response Team warning of attacks against Ukrainian authorities.

One day later, the SSU said it blocked more than 120 cyberattacks targeting the information systems of state institutions in Ukraine, including brute-force and malware attacks.

“MSTIC assesses that the primary outcome of activities by ACTINIUM is persistent access to networks of perceived value for the purpose of intelligence collection,” Microsoft also said today.

“Despite seemingly wide deployment of malicious capabilities in the region, follow-on activities by the group occur in areas of discrete interest, indicating a possible review of targeting.”