cyber.hendryadrian.com
Security News · thecyberexpress.com

CERT-UA Reports Fake Website Used to Distribute AGEWHEEZE RAT in Ukraine

· Original article ↗

Summary

CERT-UA says a fake website and phishing emails impersonating the agency distributed the AGEWHEEZE RAT to Ukrainian institutions. It assessed the campaign as largely unsuccessful, with only a few infections identified.

Key points

  • Between March 26 and 27, attackers used a fake CERT-UA website at cert-ua[.]tech and phishing emails to urge Ukrainian institutions to download a password-protected archive presented as security software.
  • The archive, available through Files[.]fm, contained AGEWHEEZE, a Go-based remote access trojan.
  • AGEWHEEZE supports screen capture, input emulation, file and process control, and persistence through registry startup entries, the Startup folder, or scheduled tasks.
  • The malware communicated with an OVH-hosted command-and-control server over WebSocket; server artifacts referenced “TVisor” and “The Cult.”
  • The Telegram channel CyberSerp claimed responsibility. CERT-UA tracked the activity as UAC-0255.
  • CERT-UA assessed the campaign as unsuccessful and identified no more than a few infected personal devices belonging to employees of educational institutions.
  • CERT-UA published indicators of compromise and recommended AppLocker or Software Restriction Policies and endpoint protection.

Article Details

Event Type
Phishing and malware campaign impersonating CERT-UA to distribute the AGEWHEEZE remote access trojan.
Impact
AGEWHEEZE provided remote control, file and process management, screen capture, and persistence capabilities. CERT-UA assessed the campaign as unsuccessful and reported that no more than a few personal devices belonging to employees of educational institutions were infected.

Indicators of compromise

TypeIndicatorContext
DOMAINcert-ua[.]techCounterfeit CERT-UA website used to support the phishing campaign and direct recipients to the malicious archive.

MITRE ATT&CK

T1053.005 · Scheduled TaskAGEWHEEZE could establish persistence using a scheduled task.T1071.001 · Web ProtocolsThe malware communicated with its command-and-control server over WebSocket connections.T1547.001 · Registry Run Keys / Startup FolderAGEWHEEZE established persistence through the Windows registry startup key and Startup directory.T1566.002 · Spearphishing LinkPhishing emails impersonated CERT-UA and urged recipients to download a malicious archive.

Threat Actors

CyberSerpThe Telegram channel CyberSerp claimed responsibility for the campaign; this attribution is based on the attackers' own claim.

Malware

AGEWHEEZEAn unknown threat actor cloned the CERT-UA website and sent phishing emails distributing a password‑protected archive that installed AGEWHEEZE, a Go‑based remote access trojan.

Vendors

OVHAll communications to its command-and-control server route over WebSocket connections to a server hosted on infrastructure belonging to French cloud provider OVH.

Countries

UkraineUkraine’s frontline cyber defense agency became the subject of its own investigation last week after an unknown threat actor built a convincing fake version of its website, sent emails impersonating its staff and

Industries

GovernmentThe phishing emails were targeted at a broad cross-section of Ukrainian institutions including government organizations, medical centers, security companies, educational institutions, financial institutions and softwareInformation Securityattackers targeted the cyber defense agency whose name carries the highest authority in Ukrainian information security communications, turning that trust directly against the institutions that rely on it.Software developmentmedical centers, security companies, educational institutions, financial institutions and software development firms.

Related Articles