Thread by @bellingcat

New from Bellingcat and @the_ins_ru

An attack that made numerous Ukrainian government websites unreachable has been linked to GRU hackers. bellingcat.com/news/2022/02/2…

@the_ins_ru Independent threat researcher Snorre Fagerland, working in cooperation with Bellingcat and The Insider, identified a web service apparently serving as a command and control centre which has played a role in past cyber-attacks linked to Russian state interests.

@the_ins_ru The same website also hosted cloned copies of a number of Ukrainian government websites, including the main webpage of the Office of the President.

@the_ins_ru Other cloned (and modified) websites found on the service include those of the Ukrainian Ministry of Justice and of a government-run petition portal.

@the_ins_ru These cloned websites were created no earlier than November 2021, around the time when Russia’s latest round of escalations against Ukraine began.

@the_ins_ru Notably the cloned version of the site of the Ukrainian president was modified to contain a clickable “Support the President” campaign that, once clicked, downloads a package of malware to the user’s computer.

@the_ins_ru It is not certain what the purpose of the malware payload is at this time, nor whether the payload was operational or simply a placeholder for different malware to be deployed at a crucial moment.

@the_ins_ru The type of malware deployed on the cloned Ukrainian websites shows a link to previous cyber attacks on the Ukrainian government dating to April 2021, as well as on the government of Georgia.

@the_ins_ru A version of this story by @the_ins_ru can be read in Russian here: theins.ru/politika/248818