Emerging Threat: Targeted Cyberattacks on Government Systems
The CERT-UA response team has detected a new series of targeted cyberattacks against government entities and defense industry enterprises.
According to the State Special Communications Service press service, the attacks are conducted by the UAC-0099 group, which has updated its tools and introduced new malware programs such as MATCHBOIL, MATCHWOK, and DRAGSTARE. The attackers employ a complex attack chain aimed at data theft and gaining remote access to systems.
The attack begins with phishing emails disguised as official documents, such as court summonses. These emails contain links to legitimate file-sharing services, and clicking on them initiates the download of a ZIP archive containing a malicious HTA file. This marks the start of a multi-stage attack.
Executing the HTA file triggers a VBScript code that creates two files on the victim's computer: one with HEX-encoded data and another with PowerShell code. A scheduled task is created to ensure the execution of this code. The next step involves the PowerShell script decoding the data and forming an executable loader file MATCHBOIL, which is embedded in the system via its own scheduled task.
The primary targets of this group are Ukrainian government agencies, defense forces, and enterprises working in the interests of the defense industry.
CERT-UA's research has identified three new samples of malware, indicating an evolution in the group's tactics, techniques, and procedures.
MATCHBOIL (Loader) is responsible for delivering the main malicious payload to the compromised computer. It collects basic system information (CPU ID, BIOS serial number, username, MAC address) to identify the victim on the command server and then downloads the next attack component, saving it as a COM file.
MATCHWOK (Backdoor) allows attackers to execute arbitrary PowerShell commands on the compromised system. Commands are sent from the command server in encrypted form and are executed through a renamed and relocated PowerShell interpreter.
DRAGSTARE (Data Stealer) performs comprehensive data collection:
- system information: computer name, OS data, processors, memory, disks, network interfaces;
- browser data: steals authentication information (logins, passwords, cookies) from Chrome and Firefox, using DPAPI for decryption;
- files: recursively searches the desktop, documents, and downloads for files with extensions .docx, .doc, .xls, .pdf, .ovpn, .rdp, .txt, compresses the found files, and sends them to the attackers' server.
RECOMMENDATIONS FROM CERT-UA
To counter the described threat and enhance overall cyber protection, the following measures should be taken:
- Strengthen control over incoming correspondence. Train employees to identify phishing emails and handle emails with download links cautiously.
- Limit script execution. Set security policies to block or monitor the execution of HTA files and VBS/PowerShell scripts, especially those launched from atypical locations.
- Implement endpoint monitoring (EDR). Track the creation of new scheduled tasks, registry auto-start entries, and suspicious activity from system utilities (powershell.exe, mshta.exe).
- Ensure protection of the network perimeter. Use modern intrusion detection systems (IDS/IPS) and proxies to filter and analyze traffic.
- Maintain software up-to-date. Regularly update operating systems, browsers, and antivirus databases to protect against known vulnerabilities.
