Ukraine Confirms Suspected APT28 Campaign Targeting Prosecutors and Anti-Corruption Agencies
Summary
Ukraine says it has tracked three campaign waves since 2023; researchers attribute the activity to APT28 and report over 170 compromised email accounts. Attackers exploited Roundcube flaws; ARMA and SAP report no confirmed internal data theft.
Key points
- Ukraine's SSSCIP says authorities have tracked the campaign since 2023; CERT-UA identified three waves.
- Western researchers report that more than 170 email accounts belonging to Ukrainian prosecutors and investigators were compromised.
- The intrusions exploited Roundcube vulnerabilities that reportedly allow code execution when a recipient opens an email, without clicking a link or downloading an attachment.
- Ctrl-Alt-Intel attributed the campaign to APT28; a Ukrainian cyber official said indications point to the group.
- A Ukrainian official said material allegedly stolen in the attacks was published online in March, but was unlikely to contain confidential data; he warned it could be used for disinformation.
- ARMA said attackers did not access its internal systems and no database or state-resource data leaked. SAP's review found no evidence of data theft from its systems and remains ongoing.
Article Details
- Victim Organization
- Ukrainian local government and law enforcement agencies, including the Specialized Anti-Corruption Prosecutor’s Office (SAP) and the Asset Recovery and Management Agency (ARMA)
- Incident Type
- Cyber-espionage campaign involving exploitation of Roundcube vulnerabilities to compromise email accounts
- Affected Records
- Western researchers reported that more than 170 email accounts belonging to Ukrainian prosecutors and investigators were compromised.
- Operational Impact
- Researchers reported compromised email accounts. ARMA said attackers did not access its internal systems and that no data leaked from its databases or state information resources. SAP reported no evidence of data theft from its systems; its review was ongoing. Ukrainian officials warned leaked material could be used for disinformation.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
People
Taras DzyubaHead of the information communications department at SSSCIP; told Recorded Future News that Ukrainian authorities were aware of the attacks and described the campaign tracked by CERT-UA.Yaroslava MaksymenkoARMA’s acting head; confirmed the agency’s employees had been targeted and said the review found no access to internal information systems or data leak from databases or state information resources.
Threat Actors
APT28The campaign was attributed to APT28 by Ctrl-Alt-Intel researchers; Ukrainian officials said indications pointed to the group. The article identifies Fancy Bear, BlueDelta, and Forest Blizzard as other names for APT28.BlueDeltaIdentified in the article as another name for APT28, which researchers attributed to the campaign targeting Ukrainian email accounts.Fancy BearIdentified in the article as another name for APT28, which researchers attributed to the campaign targeting Ukrainian email accounts.
Products
Countries
Bulgariasome compromised accounts were linked to neighboring NATO countries and the Balkans, including Romania, Bulgaria, Greece and Serbia.Greeceaccounts were linked to neighboring NATO countries and the Balkans, including Romania, Bulgaria, Greece and Serbia.Romaniaalthough some compromised accounts were linked to neighboring NATO countries and the Balkans, including Romania, Bulgaria, Greece and Serbia.Serbiawere linked to neighboring NATO countries and the Balkans, including Romania, Bulgaria, Greece and Serbia.UkraineTaras Dzyuba, head of the information communications department at Ukraine’s State Service of Special Communications and Information Protection (SSSCIP), told Recorded Future News that authorities are aware of the
Industries
Governmenta long-running cyber-espionage campaign attributed to Russia-linked APT28 targeted dozens of local government and law enforcement email accounts, with Western researchers reporting more than 170 compromisedLaw enforcementcyber-espionage campaign attributed to Russia-linked APT28 targeted dozens of local government and law enforcement email accounts, with Western researchers reporting more than 170 compromised accounts.