Microsoft recently reported that a group of cybercriminals that are controlled by Russian intelligence known as Gamredon has been targeting various organizations in Ukraine, including a western government entity.
The group is behind a streak of spear-phishing emails attacking Ukrainian entities since October 2021.
Linked by Ukraine's security (SSU) and secret (SBU) services to Russia's Federal Security Service (FSB), the country's domestic intelligence service, this cybercriminal group is also known as Armageddon, ACTINIUM, and Primitive Bear.
According to the report, in recent months, the military advisers and cyber threat experts from the United States and other allies have been sent to Ukraine to help defend against Russian forces, now massed on the neighboring country's borders.
In a report issued on Friday, Microsoft Corp (MSFT.O) said the group has been designed to obtain private data from various departments of the government entities, military, and non-governmental organizations in Ukraine since the last October.
The report has shown a screenshot of one such attempt, in which an email can be seen, embedded with malicious links, impersonated as an official notification from the World Health Organization (WHO) on the COVID-19 pandemic.
"MSTIC has observed ACTINIUM targeting organizations in Ukraine spanning government, military, non-government organizations (NGO), judiciary, law enforcement, and non-profit, with the primary intent of exfiltrating sensitive information, maintaining access, and using acquired access to move laterally into related organizations," Microsoft added.
"Since October 2021, ACTINIUM has targeted or compromised accounts at organizations critical to emergency response and ensuring the security of Ukrainian territory, as well as organizations that would be involved in coordinating the distribution of international and humanitarian aid to Ukraine in a crisis."
In November, Ukrainian security services had publicly imputed Gamaredon to a team of Russian Federal Security Service intelligence from Crimea. In this regard, the Russian Embassy in Washington did not respond immediately.
“They were officers of the ‘Crimean’ FSB, as well as traitors who sided with the enemy during the occupation of the peninsula in 2014,” Ukraine's security service said in a November news release, publicizing leaked audio of the hackers.
