cyber.hendryadrian.com
Security News · therecord.media

Pro-Russian Hackers Impersonate Ukraine’s CERT-UA in AgeWheeze Phishing Campaign

· Original article ↗

Summary

CERT-UA says UAC-0255 impersonated the agency in phishing emails that delivered AgeWheeze, a remote administration tool. It reported few infections; CyberSerp’s claims of roughly 1 million targets and 200,000 compromised devices remain unconfirmed.

Key points

  • Attackers impersonated CERT-UA in emails warning of a supposed large-scale cyberattack and directing recipients to download an archive.
  • The password-protected archive hosted on Files[.]fm contained AgeWheeze, a remote administration tool.
  • AgeWheeze can execute commands, manage files and processes, stream screens, emulate mouse and keyboard input, and access the clipboard.
  • The emails targeted organizations in government, healthcare, finance, security, education, and software development.
  • CERT-UA said the campaign caused only a small number of infections, mainly on education staff’s personal devices.
  • CERT-UA said the operation may be linked to CyberSerp, citing a phrase in the code of a fake website. The group’s claims of targeting roughly one million Ukr[.]net users and compromising more than 200,000 devices were not confirmed.

Article Details

Event Type
Phishing campaign impersonating CERT-UA to distribute the AgeWheeze remote administration tool.
Impact
CERT-UA reported only a small number of infections, mainly on education staff members’ personal devices, and said the campaign was largely unsuccessful. The attackers claimed they targeted roughly one million Ukr.net users and compromised more than 200,000 devices; CERT-UA did not confirm those figures. AgeWheeze can remotely control infected computers, execute commands, manage files and processes, stream screens, emulate mouse and keyboard input, and access the clipboard.

Threat Actors

CyberSerpCERT-UA said the operation may be linked to CyberSerp, which later claimed responsibility on Telegram. The group’s claims about the scale of targeting and device compromises were not confirmed by CERT-UA.UAC-0255CERT-UA tracked the attackers behind the phishing campaign as UAC-0255; they impersonated CERT-UA and distributed AgeWheeze.

Malware

AGEWHEEZEThe archive installed a remote administration tool called AgeWheeze that enables full remote control, and attackers claiming to be CyberSerp later boasted of large-scale targeting though CERT-UA reported only a small

Countries

UkraineA pro-Russian hacker group impersonated Ukraine’s CERT-UA in a phishing campaign that urged organizations to download a password-protected archive from Files.fm containing supposed security software.

Industries

CybersecurityA pro-Russian hacker group impersonated Ukraine’s national cyber incident response team in a phishing campaign targeting government agencies, businesses, and other institutions, Ukrainian cybersecurity officials said.EducationOrganizations across government, healthcare, finance, security, education, and software development were targeted.GovernmentOrganizations across government, healthcare, finance, security, education, and software development were targeted.HealthcareOrganizations across government, healthcare, finance, security, education, and software development were targeted.Software developmentOrganizations across government, healthcare, finance, security, education, and software development were targeted.