Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label cybercrime group. Show all posts
Spear Phishing
Critical Infrastructure Cyber Attacks cybercrime group Defense Kaspersky Russian Government Spear Phishing

Awaken Likho Targets Russian Agencies with MeshCentral Remote Access Tool

 

Awaken Likho, also referred to as Core Werewolf or PseudoGamaredon, is a cyber threat group targeting Russian government agencies and industrial entities. Since June 2024, a new campaign has been observed, where attackers have shifted from using UltraVNC to MeshCentral’s legitimate agent for remote access to compromised systems. The campaign primarily focuses on Russian government contractors and industrial enterprises, as reported by Kaspersky. Spear-phishing is a key method employed by Awaken Likho, with malicious executables disguised as Word or PDF files. 

These files trick victims by using double extensions such as “.doc.exe” or “.pdf.exe,” making them appear like standard document formats. When opened, these files trigger the installation of UltraVNC or, in the new campaign, MeshCentral’s MeshAgent tool, which grants the attackers full control over the compromised system. Awaken Likho’s cyberattacks date back to at least August 2021, first gaining attention through targeting Russia’s defense and critical infrastructure sectors. However, more recently, the group has shifted to using self-extracting archives (SFX) to covertly install UltraVNC, along with presenting decoy documents. 

In its latest campaigns, an SFX archive triggers the execution of a file named “MicrosoftStores.exe,” which unpacks an AutoIt script. This script eventually runs the MeshAgent tool, facilitating ongoing remote control via the MeshCentral server. By creating a scheduled task, Awaken Likho ensures persistence within the infected system. The scheduled task consistently runs the command file, which in turn launches MeshAgent, allowing communication with the MeshCentral server. This tactic gives the attackers access to the system long after the initial breach. Russian cybersecurity company Kaspersky has revealed that the campaign’s primary focus remains within Russian government bodies, contractors, and industrial enterprises. 

Additionally, earlier findings from BI.ZONE in June 2023 indicated that Awaken Likho has targeted sectors including defense and critical infrastructure, emphasizing the group’s intent on penetrating Russia’s most vital industries. A notable attack in May 2023 targeted a Russian military base in Armenia, as well as a research institute involved in weapons development. These actions suggest Awaken Likho’s primary focus on entities involved in Russia’s security and defense sectors, with significant consequences for the country’s critical infrastructure. 

This new chapter in Awaken Likho’s activity signals the group’s evolving tactics and its continued interest in leveraging spear-phishing attacks with more sophisticated tools. By transitioning to the MeshCentral platform, the group showcases its adaptability in maintaining control over systems while evading detection, making it a significant threat to Russian entities in the future.
Read more »
US sanctions
BitPaymer ransomware Cyber Security cybercrime group Evil Corp Maksim Yakubets new sanctions ransomware charges UK sanctions US sanctions

Evil Corp Faces New Sanctions and BitPaymer Ransomware Charges

 

The Evil Corp cybercrime group has been hit with fresh sanctions by the United States, United Kingdom, and Australia. Additionally, the U.S. has indicted a member for their involvement in BitPaymer ransomware attacks.

Back in 2019, the U.S. had sanctioned 17 individuals and 7 entities linked to Evil Corp, including its leader, Maksim Yakubets. Today, the U.S. Treasury's Office of Foreign Assets Control (OFAC) has placed sanctions on seven more individuals and two additional entities connected to the syndicate. The UK and Australia have joined the U.S. in sanctioning some of these individuals as well, either today or as part of the 2019 sanctions.

The individuals facing sanctions include Eduard Benderskiy (Yakubets’ father-in-law), Viktor Grigoryevich Yakubets (his father), Aleksandr Viktorovich Ryzhenkov, Sergey Viktorovich Ryzhenkov, Aleksey Yevgenevich Shchetinin, Beyat Enverovich Ramazanov, and Vadim Gennadievich Pogodin. The two entities, Vympel-Assistance LLC and Solar-Invest LLC, are owned by Benderskiy.

According to the U.S. Department of the Treasury, Benderskiy, a former Spetnaz officer with ties to Russian intelligence, has played a key role in facilitating Evil Corp's relationship with the Russian state. This partnership allegedly enabled the group to conduct cyberattacks and espionage operations against NATO allies prior to 2019.

Under these new sanctions, assets linked to the individuals have been frozen, and businesses in the U.S., UK, and Australia are prohibited from engaging in transactions with them. Moreover, companies that fall victim to Evil Corp’s ransomware attacks are now restricted from making ransom payments unless approved by OFAC, or they risk violating sanctions.

In another significant development, the U.S. has unsealed an indictment against Aleksandr Ryzhenkov, an alleged Evil Corp member, for his role in ransomware attacks in the U.S. Ryzhenkov is accused of using BitPaymer ransomware in numerous attacks starting in 2017. The indictment states that Ryzhenkov and his co-conspirators gained unauthorized access to victims’ computer networks, deployed the BitPaymer ransomware to encrypt files, and left ransom notes demanding payment to decrypt the data and prevent the release of sensitive information.

The UK's National Crime Agency (NCA) has identified Ryzhenkov as a LockBit affiliate, having carried out several attacks as part of Operation Cronos, an ongoing effort to disrupt ransomware operations.

Evil Corp is notorious for creating the Dridex banking trojan and various ransomware strains. Initially, the gang used Dridex to steal banking credentials and commit financial fraud. As ransomware attacks grew, the group shifted focus, creating BitPaymer in 2017 to target businesses globally. Following U.S. charges against its members in 2019, Evil Corp split, with some members forming a new operation known as DoppelPaymer, which later rebranded as Grief and Entropy.

Despite sanctions, Evil Corp continued its operations by deploying new ransomware variants under different names, such as WastedLocker, Hades, and Phoenix CryptoLocker, among others. However, as these variants shared similar code, they were traced back to Evil Corp. To further evade sanctions, some affiliates began using LockBit ransomware.
Read more »
Subscribe to: Posts (Atom)