KP in Ukraine

Summary

A Russian state-linked hacking group compromised multiple Ukrainian central and local government websites by exploiting a web shell that had been planted more than a year earlier, which was then used to deploy CredPump, HoaxPen, and HoaxApe backdoors. The intrusion was discovered when a web shell was identified on one of the affected portals, enabling the threat actors to modify webpage content while leveraging GOST and Ngrok tunneling tools to facilitate the deployment of additional malware. The incident did not cause essential system failures or disrupt the operations of Ukrainian public authorities, and joint response efforts involving the SSSCIP, Security Service of Ukraine, and Cyber Police worked to isolate and investigate the cyberattack. The same threat actor has a history of targeting Ukrainian entities with phishing campaigns and backdoors, while also demonstrating coordination with Russian state interests across North American and Western European organizations.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 23, 2023, the Computer Emergency Response Team of Ukraine (CERT-UA) detected a cyberattack affecting multiple websites belonging to Ukrainian central and local government authorities. The discovery was made after CERT-UA identified a web shell on one of the compromised sites during the morning of Thursday, February 23. According to Ukraine's State Service of Special Communications and Information Protection (SSSCIP), the attack resulted in the modification of webpage content on a number of affected government sites. The SSSCIP publicly confirmed the incident, noting that experts from the SSSCIP, the Security Service of Ukraine, and the Cyber Police were collaborating through the United Response Team operating under the National Cybersecurity Coordination Center to isolate and investigate the cyber incident. The agency also stated that the incident had not caused essential system failures or disruptions that would affect the ongoing operation of Ukrainian public authorities.

Further investigation by CERT-UA revealed that the attackers had established access to the compromised systems well before the February 23 incident. The web shell discovered during the response had been created in December 2021, approximately fourteen months earlier. Analysis showed that this web shell was subsequently used in February 2022 to deploy additional malicious tooling, including the CredPump, HoaxPen, and HoaxApe backdoors, roughly one year prior to the discovery of the compromise. During the early stages of their operation, the threat actors leveraged the GOST (Go Simple Tunnel) and Ngrok tools to facilitate the deployment of the HoaxPen backdoor onto the targeted infrastructure.

The threat actor behind this activity was tracked by CERT-UA as UAC-0056 and is also known in the broader security community as Ember Bear or Lorec53. Ember Bear has been active since at least March 2021 and has consistently focused on targeting Ukrainian entities with backdoors, information stealers, and fake ransomware, primarily delivered through phishing emails. The group began ramping up its phishing campaigns and network compromise efforts directed at Ukrainian targets starting in December 2021. Beyond Ukraine, operators suspected of belonging to the same group have been linked to attacks against organizations in North America and Western Europe, as well as phishing operations targeting Georgian government agencies. The group's activities have demonstrated coordination and alignment with Russian state interests.

The February 23, 2023 incident was not the only significant cyber event affecting Ukrainian entities during this period. In January 2023, CERT-UA disclosed a separate cyberattack attributed to the Russian Sandworm military hacking group against Ukraine's national news agency, Ukrinform. That incident involved the deployment of CaddyWiper data-wiping malware, though the attack ultimately failed to impact Ukrinform's operations. Sandworm had previously used CaddyWiper in another failed attack in April 2022 against a large Ukrainian energy provider. The February 23 discovery of the long-dormant backdoors embedded in government websites highlighted the persistent nature of the threat environment facing Ukrainian government infrastructure, where adversaries had maintained footholds in systems for over a year before the modification of public-facing web content drew renewed attention to the existing compromises.

Sources

Sources available to members: 2 sources.