45
30
45
45
30
30
30
30
Ukrainian police raid 94 fraudulent call centers, seize $2 million
Ukrainian police raided 94 fraudulent call centers impersonating banks and brokers, seizing about $2 million and thousands of devices.
Ukraine's National Police, with the Security Service of Ukraine and Prosecutor General's Office, executed 400-plus searches across 867 addresses, dismantling 94 call centers used for bank-impersonation, fake investment, and crypto-platform fraud. Seizures included 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 20 crypto wallets, and about $2 million, 64,000 euros, and a kilogram of gold. 26 people were named as suspects under fraud and money laundering charges carrying up to 12 years in prison, and one group defrauded EU citizens with German authorities cooperating.
40
45
50
30
30
45
30
45
30
30
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.
Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.
58
45
30
45
30
30
30
Hackers target Ukrainian agency managing assets seized from sanctioned Russians
Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.
Ukraine's Asset Recovery and Management Agency (ARMA), which manages assets seized from criminals and sanctioned individuals, said Tuesday it had been targeted by a cyberattack, with the SBU investigating. The attack coincided with preparations to select a manager for seized corporate rights in IDS Ukraine, a major beverage producer seized in late 2022 from Russian shareholders including sanctioned billionaire Mikhail Fridman. ARMA reported other suspected interference since spring, including unauthorized access to an internal database of agency officials, but did not attribute the attack or release technical details. In April, ARMA employees were targeted in a cyberespionage campaign attributed to Russia-linked APT28, which failed to penetrate internal systems.
45
30
30
30
30
30
30
45
30
30
30
30
45
45
30