cyber.hendryadrian.com
Security News · thecyberexpress.com

Joint Advisory Warns of GRU Campaign Targeting Ukraine-Linked Logistics Firms

· Original article ↗

Summary

A joint advisory attributes an ongoing campaign targeting logistics and technology firms supporting Ukraine to GRU Unit 26165 (APT28). It reports spearphishing, exploitation, malware and IP-camera targeting, and recommends MFA, patching and monitoring.

Key points

  • The advisory attributes the campaign to GRU Unit 26165, also known as APT28 or Fancy Bear, and says it has been active since early 2022.
  • Targets reportedly include logistics, transportation and technology organizations supporting Ukraine across air, sea and rail supply chains.
  • Reported access methods include spearphishing, credential guessing, brute force and exploitation of CVE-2023-23397, Roundcube vulnerabilities and CVE-2023-38831.
  • The advisory identifies HEADLACE and MASEPIE among the malware used in the campaign.
  • Reported post-compromise activity includes reconnaissance, lateral movement, manipulation of email permissions and collection of logistics-related information.
  • The advisory reports attempts to access internet-connected cameras near border crossings, rail stations and military facilities, including through weak credentials and unsecured RTSP servers.
  • Agencies recommend enforcing MFA, patching known vulnerabilities, monitoring logins and lateral movement, securing internet-facing systems and reviewing supplier relationships.

Article Details

Event Type
Ongoing cyber espionage campaign attributed by a joint advisory to Russian GRU Unit 26165.
Impact
The campaign targets Western logistics and technology organizations supporting aid to Ukraine, including air, sea, and rail transport and connected suppliers. The advisory reports credential attacks, spearphishing, exploitation of known vulnerabilities, lateral movement, and targeting of IP cameras. Reported objectives and effects include access to shipment and transport information, collection of communications, and monitoring aid movements; the campaign has been active since early 2022 and is ongoing.

MITRE ATT&CK

T1021.001 · Remote Desktop ProtocolThe advisory reports use of RDP for lateral movement within compromised networks.T1110.001 · Password GuessingThe advisory reports credential guessing and brute-force attacks against targets.T1566.002 · Spearphishing LinkThe advisory reports spearphishing emails that direct targets to fake login pages hosted on compromised devices or free web platforms.

CVE

CVE-2023-23397Microsoft · Microsoft 365 Apps for Enterprise; Microsoft · Microsoft Office 2019; +3 moreKnown CVEs exploited include CVE-2023-23397 (Outlook), Roundcube vulnerabilities, and CVE-2023-38831 (WinRAR), with malware like HEADLACE and MASEPIE used post-exploitation.CVE-2023-38831rarlab · winrarKnown CVEs exploited include CVE-2023-23397 (Outlook), Roundcube vulnerabilities, and CVE-2023-38831 (WinRAR), with malware like HEADLACE and MASEPIE used post-exploitation.

Threat Actors

APT28The joint advisory attributes the ongoing campaign targeting logistics and technology organizations supporting aid to Ukraine to Russian GRU Unit 26165.Fancy BearThe article identifies Fancy Bear as a tracking name for Unit 26165, which the advisory attributes to the campaign.

Malware

HEADLACEthat support aid to Ukraine through spearphishing, CVE exploitation, and deployment of malware such as HEADLACE and MASEPIE.MASEPIEaid to Ukraine through spearphishing, CVE exploitation, and deployment of malware such as HEADLACE and MASEPIE.

Vendors

MicrosoftCVE-2023-23397 in Microsoft Outlook to harvest credentials

Products

Microsoft OutlookCVE-2023-23397 in Microsoft Outlook to harvest credentialsRoundcube WebmailKnown CVEs exploited include CVE-2023-23397 (Outlook), Roundcube vulnerabilities, and CVE-2023-38831 (WinRAR), with malware like HEADLACE and MASEPIE used post-exploitation.WinRARKnown CVEs exploited include CVE-2023-23397 (Outlook), Roundcube vulnerabilities, and CVE-2023-38831 (WinRAR), with malware like HEADLACE and MASEPIE used post-exploitation.

Countries

FranceTargets span multiple countries, including the United States, Germany, Poland, France, and Ukraine.GermanyTargets span multiple countries, including the United States, Germany, Poland, France, and Ukraine.PolandTargets span multiple countries, including the United States, Germany, Poland, France, and Ukraine.Ukraine(tracked as APT28/Fancy Bear), targeting Western logistics and technology companies that support aid to Ukraine through spearphishing, CVE exploitation, and deployment of malware such as HEADLACE and MASEPIE.United StatesTargets span multiple countries, including the United States, Germany, Poland, France, and Ukraine.

Industries

DefenseSecurity agencies warn that companies involved in transportation, IT services, and defense supply chains should assume they are potential targets and strengthen monitoring and threat detection efforts.logisticsan ongoing Russian GRU cyber campaign to Unit 26165 (tracked as APT28/Fancy Bear), targeting Western logistics and technology companies that support aid to Ukraine through spearphishing, CVE exploitation, andTransportationSecurity agencies warn that companies involved in transportation, IT services, and defense supply chains should assume they are potential targets and strengthen monitoring and threat detection efforts.

Related Articles