Attack activity targeting Ukrainian .ua domains has risen, with a wide range of attack types observed and a shift toward broad automated exploit attempts. The findings detail top vectors such as malicious IPs, malicious user-agents, and attempts to upload or disclose sensitive files on Ukrainian websites.
#XO_Sp3ctra #BalaSniper #Ioptimization #Starcrecium #ChangWayTechnologies #wp_is_mobile
#XO_Sp3ctra #BalaSniper #Ioptimization #Starcrecium #ChangWayTechnologies #wp_is_mobile
Keypoints
- 16 attack types triggered more than 85 firewall rules across protected .ua websites, blocking over 9.8 million attack attempts in the last 30 days; the top five attack types accounted for over 9.7 million attempts.
- The largest blocked category was known malicious IP addresses; the top IP discussed is 152.89.196.102, tied to Chang Way Technologies Co. Limited, with thousands of blocks on .ua domains and globally.
- Attacks against Ukrainian sites come from a wide geographic spread (North America, Europe, Asia) with only a few Russian IPs in the top global list, yet Ukraine shows focused activity from some actors.
- Malicious user-agents, notably a persistent string tracked across many attacks (including wp_is_mobile), were the second-largest blocked category and help block credential stuffing on first attempts.
- Directory traversal and information disclosure are major attack categories; attackers attempt to read sensitive files like wp-config.php to gain credentials or system information.
- File upload attacks are among the top five categories, with examples like bala.php used to upload and potentially deploy backdoors or malware such as sp3ctra_XO.php.
- Conclusion: while attacks have increased since the invasion, the goals often center on information theft and spam rather than uniformly targeted exploitation; Wordfence offers incident response services for compromised sites.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Automated exploit attempts across Ukrainian websites to probe for vulnerabilities. ‘a common tactic of cyber criminals is to run automated exploit attempts, hitting as many possible targets as they can to see what gets a result. The data we have analyzed shows that this tactic is being used against Ukrainian websites.’
- [T1027] Obfuscated/Compressed Files and Information – Attackers obfuscate commands in transit via encoding. ‘a simple POST request that uses URL encoding along with base64 encoding to obfuscate a command to be run.’
- [T1190] Directory Traversal – Attacker attempts to access files outside the web root to obtain sensitive data. ‘Directory Traversal relies on a malicious actor getting into the site files wherever they can… trying to access files outside of the original file’s directory structure.’
- [T1005] Data from Local System – Information disclosure by retrieving sensitive server files such as wp-config.php. ‘Information disclosure attacks are the fourth-largest attack type… GET requests to a website, using common backup filenames… wp-config.php file … could lead to the discovery of vulnerabilities or other details.’
- [T1105] Ingress Tool Transfer – Attacker uploads malicious payloads to the server. ‘The POST request in this case includes the contents of a common PHP file uploader named bala.php… if the upload is successful they will see a message stating eXploiting Done… and the script also returns some general information about the system…’ (sp3ctra_XO.php is installed after unzip)
Indicators of Compromise
- [IP] 152.89.196.102 – part of an ASN belonging to Chang Way Technologies Co. Limited; located in Russia; blocked 78,438 times on .ua domains and 3,803,734 worldwide.
- [File] bala.php – used in a POST upload attempt to upload a payload; may lead to remote code execution.
- [File] sp3ctra_XO.php – the payload installed after a zip extraction during the file upload attack.
- [File] wp-config.php – targeted as a file whose contents could reveal database credentials.
- [File] info.php and server_info.php – files that return server configuration information when discovered.
- [URL] twentyeleven/download.php?file=..%2F..%2F..%2Fwp-config.php – directory traversal attempt to access wp-config.php.
- [User-Agent] wp_is_mobile – a malicious user-agent string observed in a large number of worldwide attacks.
Read more: https://www.wordfence.com/blog/2022/08/analyzing-attack-data-and-trends-targeting-ukrainian-domains/