APT28 Uses 'Windows Update' Phishing Emails to Target Ukrainian Agencies

Russian hacker group APT28 is targeting Ukraine's government agencies with a phishing attack by using phony Windows updates to exfiltrate system data. Since 2008, the group has been actively targeting the Ukrainian government. CERT-UA has issued a warning against this attack campaign that masquerades as system administrators of government departments. The email carries instructions and images to launch the command prompt and downloads a PowerShell script that informs about the system and sends it to attackers via Mocky service API. …

administrators apt28 attack campaign cert cert-ua data departments emails government hacker hacker group infosecnews phishing phishing attack phishing emails russian system system administrators target targeting ukraine ukrainian update updates warning windows windows update windows updates