Russia-Backed Cyber Attack: CAPTCHA Traps in Ukraine
UAC-0145 spreads malware using ClickFix method.
1ClickFix Trap Method
Russia-backed UAC-0145 group uses fake CAPTCHA checks to target Ukrainian users. Victims are tricked into executing PowerShell commands, leading to malware downloads. This highlights how effective social engineering can be in cyber attacks.
2Diverse Malware Arsenal
The attack employs various malware like GHETTOVIBE, SCOUTCURL, FLUIDLEECH, and LOADLOOP, each serving different functions from data collection to device control. FLUIDLEECH notably disguises itself as antivirus software to deceive users.
3SMARTAXE and Dynamic Content
Attackers use a custom tool called SMARTAXE to dynamically alter webpage content, displaying tailored CAPTCHA checks. The EtherHiding technique retrieves remote resource domains from Ethereum smart contracts, adding another layer of stealth.
4Android Device Infiltration
UAC-0145 also targets Android devices via APK files distributed as security tools. The COWARDDUCK backdoor collects personal data and exfiltrates it via Dropbox API, showcasing the group's multi-platform threat capabilities.
5Old vs. New Tactics
The ClickFix method marks a shift from Sandworm's earlier use of trojanized installers or fake antivirus software. This evolution underscores how threat actors continuously refine their social engineering techniques.
6Cybersecurity Alert
CERT-UA's warnings are critical for organizations and individuals in Ukraine. Vigilance against seemingly trusted mechanisms like CAPTCHAs and keeping security measures updated is essential. The new frontier of cyber warfare is shaped by social engineering.
Original article: The Hacker News — Rusya Destekli Siber Saldırı: Ukrayna'da CAPTCHA Tuzakları