Russian hackers target Ukrainian entities with info-stealing malware

Russian state-sponsored actors are continuing to strike Ukrainian entities with information-stealing malware as part of what's suspected to be an espionage operation.

Symantec, a division of Broadcom Software, attributed the malicious campaign to a threat actor tracked Shuckworm, also known as Actinium, Armageddon, Gamaredon, Primitive Bear, and Trident Ursa. The findings have been corroborated by the Computer Emergency Response Team of Ukraine (CERT-UA).

The threat actor, active since at least 2013, is known for explicitly singling out public and private entities in Ukraine. The attacks have since ratcheted up in the wake of Russia's military invasion in late 2022.

The latest set of attacks are said to have commenced on July 15, 2022, and ongoing as recently as August 8, with the infection chains leveraging phishing emails disguised as newsletters and combat orders, ultimately leading to the deployment of a PowerShell stealer malware dubbed GammaLoad.PS1_v2.

Also delivered to the compromised machines are two backdoors named Giddome and Pterodo, both of which are trademark Shuckworm tools that have been continually redeveloped by the attackers in a bid to stay ahead of detection.

Last month, Ukraine's largest private energy firm DTEK Group, which owns coal and thermal power plants in various parts of Ukraine reported that Russian hacktivists launched a major cyberattack in retaliation for its owner's opposition to Russia's war in Ukraine.