Russian attempts to phish Ukrainian targets with 'war crimes' lures unsuccessful so far, official says

Ukraine's CERT attributed the phishing effort to a Russian state-backed group known as Armageddon or Gamaredon.

Phishing attempts sent by Russian hackers to Ukrainian entities in late March with documents purportedly about Russian “war criminals” were not successful, a top Ukrainian cybersecurity official told reporters Tuesday.

Monday’s notice described email file attachments with the names “War criminals of the Russian Federation” and “War criminals destroying Ukraine (home addresses, photos, phone numbers, pages on social networks).” If opened, the attachment would have delivered malware to the target computer designed to gather information from the machine and allow for delivery of additional malicious code.

In a separate notice Monday, CERT-UA described other attacks from the same hacking group at roughly the same time targeting government agencies within the European Union, including the Latvian government.

During Tuesday’s briefing with reporters, Kirill Goncharuk, the chief information officer with Ukrtelecom, said that credentials of a company employee in one of the occupied territories of Ukraine were used in the significant service disruption that rocked the company March 28. Goncharuk declined to offer specifics as to the specific territory where the employee worked, or whether the employee was coerced to hand over their credentials or if the credentials were obtained by other means.

Also on Tuesday Zhora discussed allegations that Chinese drone manufacturer DJI was assisting Russian attacks by allowing Russian military targeting of Ukrainian drone operators via the data associated with drone operations. The SSSCIP said in its weekly digest of cyber developments Tuesday that the agency’s research has “confirmed” that DJI was assisting Russian attacks.

A request for comment sent to DJI was not returned.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure