Researchers at IBM Security X-Force are tracking a financially motivated cybercriminal group called “Hive0117” that’s impersonating a Russian government agency to target users in Eastern Europe.
“The campaign masquerades as official communications from the Russian Government’s Federal Bailiffs Service, the Russian-language emails are addressed to users in Lithuania, Estonia, and Russia in the Telecommunications, Electronic and Industrial sectors,” the researchers write. “The activity predates and is not believed to be associated with the Russian-led invasion of Ukraine.”
The phishing emails contain a malicious zip file that will install the DarkWatchman remote access Trojan. The emails attempt to convince the user to download and open this file.
“The contents of the emails feature identical Russian-language text detailing several articles related to enforcement procedures associated with the Kuntsevsky District Court of Moscow, upheld by the ‘Bailiff of the Interdistrict Department of Bailiffs for the Execution of Decisions of the Tax Authorities,’” the researchers write. “The only variation observed by X-Force within the emails is in the name and ‘case number’ associated with the individual email and accompanying malicious ZIP archive file attachment.”
The researchers note that some of the emails were specifically sent to high-ranking employees at the targeted companies.
“X-Force discovered multiple emails that were sent in mid-February 2022 to individual users, including a state-owned communication company based in Lithuania, a prominent Industrial Enterprise in Estonia, and several electronic and telecommunication businesses located in Russia,” the researchers write. “In some cases, the emails were targeting company owners, as well as individuals in leadership positions associated with Dispatch Services and Sales. Targeted organizations could be of high value to criminal actors given the targets’ potential trusted access to a wide and distributed client base.”
New-school security awareness training can teach your employees how to recognize phishing and other social engineering attacks.
Here's how it works:
