Exposed Web Panel Reveals Gamaredon Group’s Automated Spear Phishing Campaigns

Executive Summary

On February 09, 2023, EclecticIQ analysts identified a spear phishing campaign targeting Ukrainian government entities like the Foreign Intelligence Service of Ukraine (SZRU) and Security Service of Ukraine (SSU). Analysts identified a publicly exposed Simple Mail Transfer Protocol (SMTP) server and assess with high confidence that the threat actor used the SMTP server to craft and deliver phishing emails.  

The SMTP server contained a web panel designed to create and distribute spear phishing emails. It enables the email …

actor analysts attachment automated campaign campaigns cybercriminal eclecticiq email emails email spoofing entities executive exposed february gamaredon government high intelligence intelligence research intelligence service mail malicious malware nation state panel phishing phishing campaign phishing emails protocol russia security security service of ukraine server service simple smtp spear phishing spoofing ssu targeting techniques threat threat actor threat actor apt threats and vulnerabilities ukraine ukrainian vulnerabilities web