Embassies targeted in ongoing spearphishing campaign that weaponized Microsoft Excel files

Hackers filled emails U.S. State Department logos and “Top Secret” labels to trick victims into believing they were legitimate.

Embassies around the world have been targeted in a recent spate of spearphishing email attacks from Russian hackers, according to a new report from researchers at Check Point Technologies.

The emails, which the hackers filled with U.S. State Department logos and “Top Secret” labels to trick victims into believing they were legitimate, were actually laced with malicious Microsoft Excel files. The documents were capable of leveraging a trojanized version of remote access software, TeamViewer, to gain control of infected computers.

After gaining access and control, the hackers’ code allowed them to take screenshots of the victims’ PCs, allowing the hackers to steal victims’ usernames and login credentials.

They’ve had access to “everything,” Check Point’s Threat Intelligence Group Manager Lotem Finkelsteen tells CyberScoop. “Databases, personal data, documents, networks, other devices connected. They have full access to the infected device.”

The hackers succeeded in gaining full control of many of the computers they targeted, including in embassies run by Bermuda, Guyana, Liberia, Lebanon and Nepal.  The hackers were unsuccessful in attacks targeting embassies belonging to Italy and Kenya, according to Finkelsteen.

All of the targeted embassies are located in Europe, according to researchers. This could mark a new phase for the attackers, who have previously focused on mostly Russian-speaking targets.

This is not the first time these hackers have attacked — but they were more targeted in their approach this time. For instance, the files and emails the hackers sent were tailored to individuals and their roles and interests, Finkelsteen tells CyberScoop.

“This is the first time [they’re] doing targeted attacks,” Finkelsteen said. “They were targeting much broader” intentions in previous hacks.

Victims would not necessarily be aware they were infected because the attackers’ code concealed the TeamViewer interface. Likewise, screenshots that were taken were systematically deleted.

They also narrowed their campaign to target government finance officials, so it’s possible the hackers had a financial motive.

“We think that one possible explanation is the financial gain they’re trying to gain out of this attack. In this case we suspect that [the attack is] trying to gain access to high-profile bank accounts,” Finkelsteen said.

Despite the narrow targeting, Check Point researchers assess that it is likely not state-sponsored given the fact that it is “not after a specific region and the victims came from different places in the world.”

The hackers were even careless at some points in the operation — for instance, some parts of the malicious Excel sheets contained Cyrillic letters, and in some cases had instructions on how to run them in fluent Russian. Check Point researchers believe the person behind the attack may have even exposed some of the attack methods in online forums while seeking advice about hacking under the username “EvaPiks.”

The campaign is ongoing, so the hackers’ motive in targeting these officials is unclear. The financial credentials and databases could just be “leveraged to something else that has nothing to do with money,” Finkelsteen said.

Of particular concern is the fact that the trojanized TeamViewer could allow the attacker to launch additional payloads to move the attack to a new phase, but Check Point researchers have not yet identified any new attack vectors.

“We suspect this is not the last stage,” Finkelsteen said.

The Verge first reported on Check Point research.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure