Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer Out Steel and the Downloader Saint Bot
Summary: On Feb. 1, 2022, Unit 42 observed a spear phishing email sent to an employee of a Ukrainian energy organization, carrying a Word document that ran embedded JavaScript to install the SaintBot downloader and OutSteel document stealer; CERT-UA attributed the attack to the group it tracks as UAC-0056. Unit 42 traced the campaign back to at least March 2021, when the same group targeted a Western government entity in Ukraine and several Ukrainian government organizations, using themes including cryptocurrency, COVID, law enforcement and fake resumes while keeping email as the constant attack vector.
Bottom line: OutSteel scans local disks for Office documents, Access databases, Outlook data files and archives and uploads them to a hardcoded command and control server, so a single opened attachment can mean the loss of the files an energy organization would least want taken. The group's use of Discord's content delivery network to host payloads exploits the trust URL filtering systems place in that domain, and Unit 42 notes the months-long gap in observed attacks more likely reflects a lack of visibility than a pause in activity.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2017-11882
- Related
- Threat Source newsletter (June 24, 2021) Cyber Risks ·