CP
cyberpings
Malware & RansomwareHIGH

Threat Actors Impersonate CERT-UA to Distribute AGEWHEEZE

Featured image for Threat Actors Impersonate CERT-UA to Distribute AGEWHEEZE
SCSC Media
AGEWHEEZEUAC-0255CERT-UAphishingremote access tool
🎯

Basically, hackers pretended to be a security team to trick people into downloading harmful software.

Quick Summary

Hackers impersonated CERT-UA to distribute AGEWHEEZE malware via phishing emails. About 1 million users across various sectors are at risk. Strengthening security measures is crucial to combat such threats.

What Happened

Threat actors, identified as UAC-0255, have launched a sophisticated phishing campaign by impersonating the Ukrainian cybersecurity incident response team, CERT-UA. This operation aimed to distribute the AGEWHEEZE remote access tool to a wide range of potential victims.

Who's Being Targeted

The campaign targeted approximately 1 million users across various sectors, including government, healthcare, education, and finance. The attackers sent emails urging recipients to download a password-protected archive from Files.fm, which contained a fake "security tool."

How It Works

Upon installation, this tool deployed AGEWHEEZE, a multifunctional malware capable of:

  • Command execution
  • File management
  • Screen capture
  • Ensuring persistence through registry or scheduled tasks

The attackers also created a fake website, cert-ua[.]tech, mimicking the legitimate CERT-UA site to spread the malware further. Evidence suggests that the command server is hosted on OVH infrastructure and contains Russian-language elements, hinting at the attackers' origin.

Signs of Infection

Victims may notice unusual system behavior, unauthorized access to files, or unexpected network activity. If you receive suspicious emails urging software downloads, exercise caution.

How to Protect Yourself

CERT-UA emphasizes the need for organizations to reduce their attack surfaces and strengthen security measures. Recommended actions include:

  • Implementing tools like AppLocker
  • Enhancing system protections
  • Training employees to recognize phishing attempts

By taking these steps, organizations can better defend against similar phishing campaigns in the future.

🔒 Pro insight: The impersonation of CERT-UA highlights the evolving tactics of threat actors, leveraging social engineering to maximize malware distribution.

Original article from

SCSC Media
Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

Bogus Installers - RAT and Cryptominer Spread Alert

Bogus installers are being used to spread RATs and cryptominers in a long-running operation. Users are at risk of infection from these malicious downloads. Stay alert and only download software from trusted sources.

SC Media·
HIGHMalware & Ransomware

Malicious LNK Files - GitHub Used in South Korea Malware Attack

A malware campaign is targeting Windows users in South Korea using malicious LNK files and GitHub for PowerShell scripts. This stealthy attack compromises systems and poses serious risks. Stay alert and protect your network.

SC Media·
HIGHMalware & Ransomware

Akira Ransomware - Accelerated Intrusions Examined

Akira ransomware has drastically improved its attack speed, completing intrusions in under four hours. This poses a serious threat to organizations worldwide. Vigilance and preparedness are essential to combat these rapid intrusions.

SC Media·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Claude Code Leak - Exploited to Distribute Malware

A malicious GitHub repository is exploiting the Claude Code leak to distribute malware. Tens of thousands of users downloaded compromised versions, risking their sensitive data. Stay informed and protect yourself from these threats.

SC Media·
HIGHMalware & Ransomware

Storm Infostealer - New Malware Bypasses Chrome Encryption

A new malware called Storm infostealer is bypassing Chrome's encryption to steal sensitive user data, especially cryptocurrency wallets. Users in multiple countries are at risk. Stay vigilant and protect your accounts against this emerging threat!

SC Media·