Russian hackers have been accused of attempted phishing attacks against the Latvian Ministry of Defense.
Gamaredon, a Russian government-backed cyber espionage group, has a domain name (admou[.]org) was linked to gangs in previous attacks designed to steal information and gain access to networks operated by Ukraine and its allies.
Researcher at French security company Sequoia explained Hackers allegedly sent spear-phishing emails to the Latvian Ministry of Defense, posing as officials from the Ukrainian Ministry of Defense.
Since the message and its attachments were uploaded to the VirusTotal service for scanning, it appears that at least one recipient was suspicious of the message and its attachments.
The email attachment smuggled malicious code that launched a series of processes designed to help the hackers steal information from their intended targets within the Latvian Ministry of Defense.
As The Record The reason why the investigation into the attack was unusual is that once the Gamaredon hacking group became aware that the attack was being investigated, they began contacting researchers.
A CERT-LV spokesperson told The Record that hackers sent a meme depicting a Russian bear with paws to Ukraine while the US and EU tried to contain it.
FSB-affiliated Gamaredon (also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and Winterflounder) has been attacking organizations outside of Russia for at least a decade.
For example, Gamaredon hackers reportedly attempted to hack an oil refinery located in a NATO member state last year, targeting Ukrainian military and government agencies with boobytrapped Word documents.
The Latvian Ministry of Defense said the phishing attempt by the Gamaredon group was unsuccessful.
According to Latvia’s Computer Emergency Response Team (CERT-LV), cyberattacks in the country have increased by 30% since the start of the war in Ukraine, with the most serious threats coming from pro-Russian hacktivists and Kremlin-backed hackers. It targets critical infrastructure and enterprises. , and the Latvian government.
