Ukraine Says Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Summary
Ukraine's SSU says it and the FBI uncovered a long-running Russian intelligence campaign using fake messaging-app support SMS to steal credentials and sensitive information. The article also describes separate phishing activity attributed to named actors.
Key points
- The SSU says it and the FBI uncovered a long-running campaign attributed to Russian intelligence, targeting officials, military personnel, politicians and activists in Ukraine, Europe and the U.S.
- The attackers allegedly impersonated messaging-platform support bots in SMS messages to trick victims into disclosing account credentials.
- The SSU said the campaign also targeted personal accounts and did not attribute it to a specific hacking group.
- Separate attack waves targeting Signal and WhatsApp users have been attributed to Star Blizzard, UNC5792 and UNC4221.
- The FBI attributed a separate ongoing campaign targeting high-value users of commercial messaging apps to Russian intelligence actors seeking backup recovery keys.
- CERT-UA attributed a separate spear-phishing campaign against government organizations to UNC1151; it used compromised accounts to deliver the OYSTERBLUES information stealer.
- The article advises reviewing active sessions, enabling two-factor authentication, avoiding unknown QR codes, and not sharing account codes, passwords or recovery keys.
Article Details
- Event Type
- Phishing and credential-theft campaign targeting messaging accounts
- Impact
- The SSU said the campaign sought access to sensitive military, political, economic, and personal information by using SMS messages posing as messaging-platform support bots to obtain account credentials. Targets included government officials, military personnel, politicians, activists, and personal accounts in Ukraine, Europe, and the U.S. The article also reports separate phishing activity targeting commercial messaging-app users for backup recovery keys and a spear-phishing campaign that delivered the OYSTERBLUES information stealer.
MITRE ATT&CK
Threat Actors
GhostwriterThe article identifies Ghostwriter as an alternate name for UNC1151, which CERT-UA attributed with a spear-phishing campaign targeting government organizations and delivering OYSTERBLUES through compromised accounts.Russian Intelligence Services (RIS)The FBI attributed an ongoing commercial messaging application phishing campaign targeting high-value individuals and seeking their backup recovery keys to Russian Intelligence Services (RIS). The SSU did not attribute its described campaign to a specific group.Star BlizzardSimilar attack waves targeting Signal and WhatsApp users have been attributed to Russian threat activity clusters including Star Blizzard.UAC-0057The article identifies UAC-0057 as an alternate name for UNC1151, which CERT-UA attributed with a spear-phishing campaign targeting government organizations and delivering OYSTERBLUES through compromised accounts.UAC-0185The article identifies UAC-0185 as an alternate name for UNC4221, which it lists among Russian threat activity clusters attributed with similar attacks targeting Signal and WhatsApp users.UAC-0195The article identifies UAC-0195 as an alternate name for UNC5792, which it lists among Russian threat activity clusters attributed with similar attacks targeting Signal and WhatsApp users.UNC1151CERT-UA attributed a spear-phishing campaign targeting government organizations and using compromised accounts to deliver OYSTERBLUES to UNC1151; the article describes the actor as Belarus-aligned and gives Ghostwriter and UAC-0057 as alternate names.UNC4221Similar attack waves targeting Signal and WhatsApp users have been attributed to this Russian threat activity cluster; the article identifies UAC-0185 as an alternate name for UNC4221.UNC5792Similar attack waves targeting Signal and WhatsApp users have been attributed to this Russian threat activity cluster; the article identifies UAC-0195 as an alternate name for UNC5792.
Malware
Products
Countries
BelarusLate last month, the Computer Emergency Response Team of Ukraine (CERT-UA) attributed to the Belarus-aligned threat actor known as UNC1151 (aka Ghostwriter and UAC-0057) a spear-phishing campaign that targetedUkraineThe SSU and FBI uncovered a long-running Russian intelligence campaign targeting messaging accounts of officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.United StatesThe SSU and FBI uncovered a long-running Russian intelligence campaign targeting messaging accounts of officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.
Industries
Governmentcampaign orchestrated by Russian intelligence services to break into the messaging accounts of government officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.MilitaryThe SSU and FBI uncovered a long-running Russian intelligence campaign targeting messaging accounts of officials, military personnel, politicians, and activists in Ukraine, Europe, and the U.S.