Hackers target European Officials
Details of a new nation-state-sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what’s seen as an attempt to obtain intelligence on refugee and supply movement in the region.
Enterprise security company Proofpoint, which detected the malicious emails for the first time on February 24, 2022, dubbed the social engineering attacks “Asylum Ambuscade.”
“The email included a malicious macro attachment which utilized social engineering themes pertaining to the Emergency Meeting of the NATO Security Council held on February 23, 2022,” researchers Michael Raggi and Zydeca Cass said in a report published Tuesday.
“The email also contained a malicious attachment which attempted to download malicious Lua malware named SunSeed and targeted European government personnel tasked with managing transportation and population movement in Europe.”
The findings build on an advisory issued by the State Service of Special Communication and Information Protection of Ukraine (DSSZZI), which warned last week of phishing messages targeting its military personnel with ZIP file attachments with the goal of stealing sensitive personal information.
Proofpoint declined to attribute the newly observed campaign to a specific threat actor, but noted that the overlaps in the timeline of the two sets of attacks, the phishing lures used, and the victimology patterns aligns with that of a Belarusian nation-state group called UNC1151 (aka TA445 or Ghostwriter).
One of the notable aspects of Asylum Ambuscade is the likely use of a compromised Ukrainian armed service member’s email account to broadcast malware-laced email messages containing a macro-enabled XLS file that delivers SunSeed onto infected hosts, implying that the latest campaign may be a continuation of these attacks.
“The social engineering lures utilized in this phishing campaign were very timely, following a NATO Security Council meeting on February 23, 2022 and a news story about a Russian government ‘kill list’ targeting Ukrainians that began circulating in Western media outlets on February 21, 2022,” the researchers noted.
SunSeed, for its part, functions as a downloader that establishes communications with an actor-controlled server to retrieve next-stage payloads for execution.
The Sunnyvale-based cybersecurity company noted that the attacks specifically singled out individuals who were tasked with responsibilities related to transportation, financial and budget allocation, administration, and population movement within Europe.
Hackers target European Officials
