CERT-UA warns about vermin-related phishing attacks with PoW bait

August 22, 2024
1 min read

TLDR:

  • CERT-UA Warns of new phishing attacks linked to Vermin
  • Phishing messages contain alleged PoW photos and lead to malware installation

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning about new phishing attacks associated with a threat cluster known as UAC-0020 or Vermin. These attacks involve sending phishing messages with photos of alleged prisoners of war (PoW) from the Kursk region, prompting recipients to click on a link that leads to a ZIP archive containing malware. The malware installs components of known spyware SPECTR as well as a new malware called FIRMACHAGENT, which retrieves stolen data and sends it to a remote server.

Vermin, the group behind these attacks, has been linked to security agencies of the Luhansk People’s Republic (LPR) and has previously targeted defense forces in Ukraine with similar campaigns. SPECTR, the malware involved, is designed to harvest a wide range of information including files, screenshots, credentials, and data from messaging apps like Element, Signal, Skype, and Telegram.

Organizations are advised to stay vigilant against these phishing attacks and ensure their systems are protected from such malware installations.

Latest from Blog

Top 20 Linux Admin Tools for 2024

TLDR: Top Linux Admin Tools in 2024 Key points: Linux admin tools streamline system configurations, performance monitoring, and security management. Popular Linux admin tools include Webmin, Puppet, Zabbix, Nagios, and Ansible. Summary

Bogus job tempts aerospace, energy workers

TLDR: A North Korean cyberespionage group is posing as job recruiters to target employees in aerospace and energy sectors. Mandiant reports that the group uses fake job descriptions stored in malicious archives