Fancy Bear campaign sought emails of high-level Ukrainians and their military suppliers

Russian hackers aren’t just targeting Ukraine — they also appear to be going after their defense contractors in other countries, new ESET research surmises.

Fancy Bear, the hacking group linked to Russia’s Main Intelligence Directorate (GRU), has been targeting the email accounts of high-ranking Ukrainian officials as well as executives at defense contractors located in other countries who sell weapons and equipment to Kyiv, according to new research from ESET.

The campaign, ongoing since at least 2023, has taken advantage of spearphishing and cross-site scripting vulnerabilities in different webmail software products, including Roundcube, Horde, MDaemon and Zimbra.

Just one of those vulnerabilities was a zero-day that ESET researchers suspect was first identified by Fancy Bear, also known as APT28 or “Sednit” in ESET’s tracking terminology. The group was observed leveraging CVE-2024-11182 in November 2024 emails sent to two Ukrainian state-owned defense companies and a Ukrainian civilian air transport company.  

Matthieu Faou, senior malware researcher at ESET, provided CyberScoop with further detail on that rationale.

“What we know is that, according to our telemetry, Sednit is the only threat actor using this specific exploit,” Faou said in an email. “This means that they either developed this capability in house, or that they bought it from a third-party vendor/exploit broker.”

The remaining webmail programs were compromised using known vulnerabilities that already had patches available. There is evidence that the Russian hacking group has been heavily focused on webmail software since 2023, steadily identifying and adding more vulnerabilities that can target and break into a wide variety of programs.

According to the report, the victims in 2024 alone included officials from regional national governments in Ukraine, Greece, Cameroon and Serbia, military officials in Ukraine and Ecuador, and employees of defense contracting firms in Ukraine, Romania and Bulgaria.

Fancy Bear is perhaps best known in the United States for its hack and leak of Democratic National Committee emails in the lead-up to the 2016 presidential election. Since the start of the Russia-Ukraine war, the unit has increasingly turned its focus to collecting political and wartime intelligence from the conflict.

Last month, the French Ministry for Europe and Foreign Affairs accused the group of attempted or successful hacks against a dozen French entities since 2021 and trying to “destabilize” French elections in 2017 through covert and cyber means.

The ministry’s statement also accused the Russian government of using APT28 “to exert continual pressure on Ukrainian infrastructures amid Russia’s war of aggression against Ukraine,” adding that “many European partners have also been targeted by APT28 in recent years.” This week, French intelligence agencies released a 16-page assessment detailing the hacking group’s targeting of French governments and organizations dating back to 2015.

Faou said ESET identified at least 17 separate victim organizations in the webmail campaign. When asked how many were compromised, he said ESET’s endpoint was able to block the email, the malicious script or the network connection during data exfiltration for “most” of those organizations.

“Most of the targets are related to the current war in Ukraine; they are either Ukrainian governmental entities or defense companies in Bulgaria and Romania. Notably, some of these defense companies are producing Soviet-era weapons to be sent to Ukraine,” the report stated.

The group’s spearphishing lures used fake headlines from prominent Ukrainian news outlets like the Kyiv Post about the Russia-Ukraine war, seemingly playing on their targets’ personal or business interests in the conflict. Some headlines, written in Ukrainian, were “SBU arrested a banker who worked for enemy military intelligence in Kharkiv” and “Putin seeks Trump’s acceptance of Russian conditions in bilateral relations.”

Those who opened the emails using the affected webmail clients were then served up — via cross-site scripting — a custom JavaScript malware payload capable of exfiltrating data from the account’s email messages, address book, contacts and log-in history.

At least one of the vulnerabilities, affecting MDaemon software, could steal passwords and secrets for the account’s two-factor authentication, meaning attackers could bypass the security protection and access the victim’s mailbox using another application.

The malware uses flaws in webmail software programs to steal an account’s credentials, either by tricking the browser or password manager into pasting those credentials into a hidden form or getting the user to log out, whereupon they can be served fake phishing landing pages to log back in.

While the JavaScript code lacks the kind of sophisticated persistence mechanisms that are routinely deployed by state-backed hackers to maintain their access, ESET researchers note that the malware is reloaded every time the victim opens the malicious email.

Faou described the GRU-linked hacking operation as ongoing, with the last detected email flagged April 17.

“While we do have a good understanding of the TTPs used in this operation, we continue to closely track it to be able to detect the exploitation of new [zero days] in webmail applications as fast as possible,” he wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure