Cyber Incident Victim: United Nations
Date:
Jan 2020
Location:
United States of America
Summary
The United Nations was targeted in a phishing campaign where attackers impersonated Norwegian officials to distribute Emotet malware via malicious Microsoft Word attachments. Hundreds of staff members were tricked into enabling macros that downloaded the malware, which subsequently spread spam emails and deployed additional payloads including the TrickBot trojan linked to ransomware threats. The attack compromised login credentials and enabled further malicious activities through downloaded secondary malware.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 15, 2020, the United Nations headquarters in New York was targeted by a phishing campaign deploying the Emotet malware. Attackers impersonated representatives from the Permanent Mission of Norway, sending emails to hundreds of UN staff and officials claiming a "problem" existed with an attached signed agreement. The emails directed recipients to review a malicious Microsoft Word document, which displayed a spoofed template with a pop-up warning stating the document was only accessible via desktop or laptop versions of Microsoft Office Word. Users were prompted to click 'Enable editing' or 'Enable Content' to view the document, triggering malicious macros that downloaded and installed Emotet onto their devices. The attack specifically exploited trusted communication channels to bypass security awareness, leveraging the legitimacy of diplomatic correspondence to increase success rates.
Once activated, Emotet operated covertly to harvest login credentials and propagate itself by sending spam emails to additional UN targets from compromised accounts. The malware further downloaded secondary payloads, including the TrickBot trojan, which facilitated lateral movement within the network and data exfiltration. Researchers from cybersecurity firm Cofense identified the campaign, noting its connection to TrickBot’s established links to Ryuk ransomware, though no ransomware deployment was confirmed in this incident. The attack’s primary impact involved unauthorized access to UN systems, potential theft of sensitive credentials, and disruption to operational continuity due to the malware’s persistent background activity. No specific containment measures or remediation actions by the UN were detailed in the available reporting. The incident underscored the persistent threat of socially engineered attacks against high-profile international organizations.