Russian-linked group UAC-0099 reportedly used a phishing email with a malicious attachment to enter the network of an unnamed Ukrainian grain logistics company. Researchers believe the group then handed access to Sandworm, which carried out a data-wiping attack two months later, disrupting the victim rather than seeking a ransom.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Please review the attached document.” That’s how this started. At a Ukrainian grain logistics firm, a phishing attachment let UAC-0099 in. MatchWok kept access; MythicRatatoskr enabled remote commands, file theft, and screenshots. Here’s the twist: researchers believe that access passed to Sandworm. About two months later, it wiped data. One routine-looking file became a delayed disruption. Unexpected document, even about a shipment? Before opening it, call the sender using a number you already know.
Check Point researchers identified a large credential-phishing campaign that used counterfeit calendar invitations to send people to fake Microsoft sign-in pages. The campaign used calendar attachments and deceptive meeting links, and targeted more than 40,000 organizations with over 302,000…
A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic…
This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…
Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that…
Lazarus targeted South Korean organizations with spear-phishing emails that linked to fake, tailored résumé, portfolio, and interior-design websites. Visiting the sites likely triggered an infection through commonly required financial-security software, allowing the attackers to install malware…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
