Friday , May 9 2025

CERT warns for sophisticated hacker group; stealing data 30 minutes after a breach

The Gamaredon hacking operates in rapid attacks, stealing data from breached systems in under an hour. Gamaredon, also known as Armageddon, UAC-0010, and Shuckworm, is a Russian cyber-espionage hacking group that enjoys state sponsorship. Some cybersecurity researchers are connected to the Russian Federal Security Service (FSB) because some of their members used to work for the SSU but left for Russia in 2014.

How they attack:

Microsoft Patches Four Critical Azure and Power Apps Vulns

Microsoft has fixed critical vulnerabilities in its core cloud services, including Azure Automation, Azure Storage, Azure DevOps, and Microsoft Power...
Read More
Microsoft Patches Four Critical Azure and Power Apps Vulns

Qilin Ransomware topped April 2025 with 45+ data leak disclosures

The cyber threat landscape is rapidly changing, with a notable increase in ransomware activity in April 2025, driven by the...
Read More
Qilin Ransomware topped April 2025 with 45+ data leak disclosures

SonicWall Patches 3 Flaws in SMA 100 Devices

SonicWall has released patches for three security flaws in SMA 100 Secure Mobile Access appliances that could allow remote code...
Read More
SonicWall Patches 3 Flaws in SMA 100 Devices

Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors,...
Read More
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed

Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

Cisco has issued a security advisory for a critical vulnerability in its IOS XE Software for Wireless LAN Controllers (WLCs)....
Read More
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA

CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization...
Read More
CVE-2025-29824  Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day

Hacker exploited Samsung MagicINFO 9 Server RCE flaw

Hackers are exploiting an unauthenticated remote code execution vulnerability in the Samsung MagicINFO 9 Server to take control of devices...
Read More
Hacker exploited Samsung MagicINFO 9 Server RCE flaw

CISA adds Langflow flaw to its KEV catalog

CISA added the Langflow vulnerability, CVE-2025-3248 (CVSS score 9.8), to its Known Exploited Vulnerabilities catalog. Langflow is a popular tool...
Read More
CISA adds Langflow flaw to its KEV catalog

Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

Google has released its monthly Android security updates, addressing 46 vulnerabilities, including one that has been actively exploited. CVE-2025-27363 (CVSS...
Read More
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers

UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

The Cyber Security Club, representing the Department of Computer Science and Engineering at the University of Asia Pacific (UAP), has...
Read More
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition

The hackers mostly use emails and messages in instant messengers (Telegram, WhatsApp, Signal) they send from earlier compromised accounts as a primary compromise vector. The most widespread method is sending an archive containing an HTM or HTA file, initiating a chain of infection upon opening.

There is an option of spreading malware through infecting removable storage media, legitimate files (especially shortcuts), as well as through modifying Microsoft Office Word templates, thus infecting every document created on the device by adding a respective macro.

Within 30–50 minutes following the initial infection, the perpetrators are able to steal files with the extensions .doc, .docx, .xls, .xlsx, .rtf, .odt, .txt, .jpg, .jpeg, .pdf, .ps1, .rar, .zip, .7z, .mdb, mostly by using GAMMASTEEL malware products.

A device operating in the affected status for about a week may contain 80 to 120 or more malicious (infected) files, apart from the files to be created on removable media that have been connected to the device during this period.

Specialists of the Computer Emergency Response Team of Ukraine (CERT-UA) acting under the SSSCIP have analyzed current tactics, techniques and procedures employed by the UAC-0010 (Armageddon /Gamaredon), one of the most active and dangerous russian hacking groups.

As mentioned earlier, the group includes former “officers” of the Security Service of Ukraine in the Autonomous Republic of Crimea, who have betrayed their homeland and started ministering to Russian federal security.

Cyber spying against Ukrainian security and defense forces is the group’s key objective. Additionally, there is at least one known case of destructive activity at an information infrastructure facility.

According to the CERT-UA, the number of infected computing devices operating mostly within information and communication systems of public agencies can reach several thousand at a time.

CERT-UA says, In case of a detected exposure upon the indicators specified by the CERT-UA, please report to the ITC Cybersecurity Center immediately.

Besides, specialists of the Computer Emergency Response Team of Ukraine urge soldiers of the Armed Forces of Ukraine to contact the ITC Cybersecurity Center (m/u А0334; email: [email protected]) at once if your device lacks an EDR class protection software (not antivirus) to have appropriate software installed.

 

Check Also

SK Telecom

South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked

South Korea’s largest mobile operator, SK Telecom, is warning that a malware infection allowed threat …

Leave a Reply

Your email address will not be published. Required fields are marked *