UAC-0056 cyberattack on Ukrainian authorities using GraphSteel and GrimPlant malware
Excerpt
1/2
CERT-UA
cert.gov.ua/article/38374
general information
The Governmental Computer Emergency Response Team of Ukraine CERT-UA received information on the distribution of e-mails on the topic "Wage arrears" among government agencies of Ukraine. Attached to the letter is the document "Wage arrears.xls", which contains legitimate statistics and macros. At the same time, hex-coded data has been added to the mentioned document as an attachment. The macro, after activation, will decode the data, create the EXE-file "Base-Update.exe" on the computer and execute it.
This file is a downloader developed using the GoLang programming language. The program will download and run another bootloader, which, in turn, will download and run malware GraphSteel and GrimPlant on your computer.
The…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by app.box.com on app.box.com.
More from app.box.com4
- Inexsmar: An unusual DarkHotel campaigapp.box.com · Added 2 May
- North Korea-linked APT attack found disguised as a digital asset wallet service customer centerapp.box.com · Added 1 May
- Operation Triangulation: The last (hardware) mysteryapp.box.com · Added 17 Dec 2024
- Operation ShadowCat: Targeting Indian Political Observers via a Stealthy RATapp.box.com · Added 1 Aug 2024
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
