Threat Actors Distribute Fake Antivirus That Install Malware In Ukraine

Share post:

Threat actors are distributing fake Windows antivirus updates in Ukraine.

According to Ukraine’s Computer Emergency Response Team, the fake antivirus update install Cobalt Strike and other malware.

Cobalt Strike offers offensive security capabilities, facilitates lateral network movement, and ensures persistence.

The fake antivirus is distributed via phishing emails impersonating Ukrainian government agencies.

The phishing email contains a link to a French website that offers download buttons for the alleged AV software updates.

After downloading and running the fake BitDefender Windows update, the victim is prompted to install a ‘Windows Update Package.’

The package instead downloads and installs the one.exe file from the Discord CDN, which is a Cobalt Strike beacon.

The Ukrainian Computer Emergency Response Team claimed a sophisticated Russian-speaking APT known as UAC-0056 is behind the campaign.

UAC-0056 uses a combination of phishing emails and custom backdoors to collect information from Ukrainian organizations.

For more information, read the original story in BleepingComputer.

SUBSCRIBE NOW

Related articles

Sleeper Supply Chain Attack Activates After 6 Years

A coordinated supply chain attack has compromised between 500 and 1,000 e-commerce websites by exploiting vulnerabilities in 21...

Russian-Controlled Open Source Tool Raises Alarms Over U.S. Cybersecurity

A widely used open-source Go library, easyjson, used in healthcare, finance and even defence has come under scrutiny...

Signal Archiving Tool Used By Trump Admin Is Breached, Raising Alarms Over Messaging Security (EDITORIAL)

(EDITORIAL) A messaging tool used by Trump administration officials to archive encrypted Signal messages has been hacked —...

Anthropic Warns: AI “Virtual Employees” Could Pose Security Risks Within a Year

Anthropic, a leading artificial intelligence company, anticipates that AI-powered virtual employees could begin operating within corporate networks as...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways