Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

This huge Russian phishing campaign is hitting targets across the world

How to prevent phishing attacks.

Cybersecurity researchers have observed a significant uptick in Russian phishing campaigns targeting government agencies and other organizations in the West.

In a new research report, Proofpoint said that it spotted APT28, AKA Fancy Bear, distributing a larger amount of malicious emails to targets across Europe and North America. 

The campaign started in March 2023 and resulted in tens of thousands of phishing emails sent to organizations in government, aerospace, education, finance, manufacturing, and technology sectors.

Outlook and WinRAR

US intelligence puts Fancy Bear under the direct command of the Russian General Staff Main Intelligence Directorate (GRU).

These emails carry either malicious files, or links, and try to exploit multiple vulnerabilities that the cybersecurity community discovered, and patched, months ago. This means that Fancy Bear is after organizations that aren’t that diligent when it comes to their systems and endpoints.

Proofpoint singles out two vulnerabilities - CVE-2023-23397, which is an elevation of privilege flaw found in Microsoft Outlook, and CVE-2023-38831, a remote code execution flaw discovered recently in WinRAR. While the former allows ATP28 to exploit TNEF files and grab a hash of the target’s NTLM password, the latter allows for the execution of “arbitrary code when a user attempts to view a benign file within a ZIP archive.” 

While the campaign’s goal is debatable, it’s most likely to gather intelligence. This could be particularly damaging if the campaign is successful in the government, aerospace, and technology sectors. 

The last time we heard of APT28 was in late spring 2023 year when the group was targeting Ukrainian government employees with information-stealing malware by posing as IT staff working in these institutions. After successfully contacting their targets, the hackers would talk them into running a PowerShell command which would download information-stealing malware.

More from TechRadar Pro

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.