Russian Hackers Conducting Phishing Attacks in Ukraine, Warns Google TAG.
Google's Threat Analysis Group (TAG) has warned of large-volume phishing campaigns aimed at hundreds of users in Ukraine by elite hackers associated with Russia's military intelligence service. The state-sponsored cyber actor, also tracked as APT28 and FROZENLAKE, has been active since at least 2009, targeting media, governments, and military entities for espionage. The latest intrusion set involved the use of reflected cross-site scripting (XSS) attacks in various Ukrainian government websites to redirect users to phishing domains and capture their credentials. Other threat actors of interest include FROZENBARENTS and PUSHCHA, both of which are known to act on behalf of Russian interests.