Details of a new nation-state sponsored phishing campaign have been uncovered setting its sights on European governmental entities in what’s seen as an attempt to obtain intelligence on refugee and supply movement in the region.
Enterprise security company Proofpoint, which detected the malicious emails for the first time on February 24, 2022, dubbed the social engineering attacks “Asylum Ambuscade.”
“The email included a malicious macro attachment which utilized social engineering themes pertaining to the Emergency Meeting of the NATO Security Council held on February 23, 2022,” researchers Michael Raggi and Zydeca Cass said in a report published Tuesday.
“The email also contained a malicious attachment which attempted to download malicious Lua malware named SunSeed and targeted European government personnel tasked with managing transportation and population movement in Europe.”
The findings build on an advisory issued by the State Service of Special Communication and Information Protection of Ukraine (DSSZZI), which warned last week of phishing messages targeting its military personnel with ZIP file attachments with the goal of stealing sensitive personal information.
Proofpoint declined to attribute the newly observed campaign to a specific threat actor, but noted that the overlaps in the timeline of the two sets of attacks, the phishing lures used, and the victimology patterns aligns with that of a Belarusian nation-state group called UNC1151 (aka TA445 or Ghostwriter).
images from Hacker News