Events in cyberspace remain focused on the current Russo-Ukrainian war, which generates a significant amount of events. Both pro-Ukraine and pro-Russian factions have launched attacks with various degrees of sophistication against organizations of both countries. Involvement from Russian state-sponsored threat actors has reportedly been affected by the disruption of Command-and-Control (C2) servers controlled by Russia’s Main Intelligence Directorate (GRU). Hacktivists and cybercriminals from both sides remain active in targeting companies and individuals.
While the war is stealing the focus from other events, both Chinese and North Korean threat actors have been active in April 2022. At least one (1) Chinese-based threat actor has been observed using vulnerabilities to expand their infrastructure while the Lazarus group has reportedly stolen around 620 million worth of Ethereum.
Cyber-Related Events from the Russo-Ukrainian War
- On March 28, 2022, the Russian Commission on Telecommunications and IT acknowledged a network equipment shortage caused by Western sanctions. This shortage caused an increase of 40% in the prices of IT equipment;
- On March 28, 2022, Twitter user @MalwareHunterTeam reported that pro-Russian threat actors were installing malicious JavaScript on compromised WordPress sites to perform DDoS attacks against Ukrainian and pro-Ukrainian targets;
- On April 5th, 2022, German authorities seized the Hydra dark web marketplace. This specific marketplace was a significant Peer-to-Peer (P2P) cryptocurrency exchange for cybercriminals. Combined with sanctions and the Russian government’s tight control of cryptocurrencies exchanges, Russian cybercriminals are seeking new ways to cash out their criminally earned income.
- On April 6, 2022, the Cyclops Blink botnet – deployed by Russia’s Main Intelligence Directorate (GRU) – was disrupted by U.S. and U.K law enforcement departments;
- On April 7, 2022, Microsoft has taken down domains used in attacks against Ukraine;
- On April 12, 2022, a Ukrainian energy provider has been reported to be affected by the Industrial Control System (ICS)-capable malware Industroyer2;
- On April 14, 2022, a report from Group-IB described that the OldGremlin ransomware gang has targeted Russian companies using sanction-themed phishing emails and Office365 documents shared via DropBox.
- From March 29 to April 14, 2022, Russian phishing campaigns targeted Russian government dissidents, Eastern European defense departments, EU government agencies and Ukrainian government officials. New malware variants were used that allowed bypass of sandbox environments using VBScript and various fake API calls among other techniques;
Chinese Cyber Operations
- On March 30, 2022, a report stated that APT19 targeted VMware Horizon servers with the Log4Shell exploit to install their digitally signed Fire Chili rootkits. While looking into this latest campaign, Fortinet found several overlaps with APT41, another Chinese threat actor known for using digitally signed certificates. The same actor has previously targeted gaming companies;
- On April 5, 2022, APT10 has targeted global government, legal, religious, and non-governmental organizations, including in Europe, Asia, and North America. Sodamaster – a homemade malware was deployed during that campaign. The same tool was used against Japanese targets in a cyber operation that started in March 2019.
Lazarus’ Major Crypto Heist
- On March 29, North Korean state-sponsored threat actor APT38, a.k.a Lazarus Group was able to steal millions worth of cryptocurrency. The group leveraged a form of a trojanized decentralized finance (DeFi) wallet application for Windows and MacOS. Using this decoy application and social engineering techniques, the hackers were able to steal $620 million USD in Ethereum (ETH). The FBI later released a statement to confirm the attribution to the group.
- On April 14, 2022, a report was released describing the Lazarus Group’s activity against companies in the chemical industry in an ongoing operation called Operation Dream Job. This attack used fake job offers to lure their victims into clicking malicious links. According to Symantec, “The Lazarus group is likely targeting organizations in the chemical sector to obtain intellectual property to further North Korea’s own pursuits in this area.”
Additional Reading
- TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, CISA, https://www.cisa.gov/uscert/ncas/alerts/aa22-108a, April 20, 2022
- Special Report: Ukraine, An overview of Russia’s cyberattack activity in Ukraine. Microsoft, https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd, April 27th, 2022.
- Russia Began Setting Stage for Cyberattacks Against Ukraine a Year Ago, Zero Day, https://zetter.substack.com/p/russia-began-setting-stage-for-cyberattacks, April 27th, 2022.
Related Services
- WordPress Security: protect your WordPress site from attacks
- Microsoft 365 Security: help reduce the risk of successful phishing attacks against users
- User-Awareness Training: help your users identify phishing and other social engineering threats
