- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Russia(high confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0595 · uac-0094
RussiaWhat it is
State Service of Special Communication and Information Protection of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts. The Ukrainian CERT attributes the hacking campaign to threat actors tracked as UAC-0094. Threat actors are targeting Telegram users by sending Telegram messages with malicious links to the Telegram website in order to gain unauthorized access to the records and transfer a one-time code from SMS.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- Hacking Team UEFI Rootkit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de