Hackers are pretending to be drone companies and state agencies to spy on Ukrainian victims

Summary: Ukrainian government agencies and military organizations are being targeted by hackers impersonating drone manufacturers and state agencies through phishing attacks. The attackers aim to implant information-stealing malware and have been traced as UAC-0226, utilizing hacked email accounts to deploy malicious documents. Recent reports indicate the use of both new spyware and malware designed to capture sensitive browser data, with a focus on key institutions near the eastern border of Ukraine.

Affected: Ukraine’s armed forces, law enforcement agencies, local government bodies

Keypoints :

• Unauthorized impersonation of Ukrainian drone manufacturers in phishing attacks.
• Deployment of two types of malware: one from GitHub and another named GiftedCrook to steal browser data.
• Discovery of new spying malware called Wrecksteel targeting Ukrainian government and critical infrastructure.