FortiGuard Labs is aware of various campaigns targeting Ukraine by threat actors known as ACTINIUM/Gamaredon/DEV-0157. ACTINIUM’s modus operandi targets various verticals to conduct cyber espionage, including but not limited to governmental, NGO, law enforcement and nonprofit organizations. This latest campaign targeting Ukraine was observed by security analysts at Microsoft. Observed TTPs of ACTINIUM include spearphishing emails using specially crafted Microsoft Word documents that contain malicious macros. Other observed tactics use image files in the emails that are very tiny in scale and report back to the hosting server so that the attacker can check to see if the email was viewed or not. Of course, this depends on whether the recipient chooses to download images or not.Previous analysis on Gamaredon (another name for ACTINIUM) conducted by FortiGuard Labs can be found here. FortiGuard Labs also documented attacks against Ukraine here.What are the Technical Details of the Attack?ACTINIUM uses multiple stage processes that contain payloads that download and execute further additional payloads. Observed staging techniques contain highly obfuscated VBScripts, PowerShells, self-extracting archives, LNK files, etc. To remain persistent, ACTINIUM relies on scheduled tasks. To evade detection and analysis, the usage of randomly generated dictionary words from a predefined word list were used to assign subdomains, scheduled tasks and file names to further confuse analysts. Other observations seen are the usage of DNS records that are frequently changed and contain unique domain names using multiple IP addresses attributed to them.Three malware families were documented in the report, and they are:PowerPunch – Downloader and droppers using PowerShellPterodo – Malware that uses various hashing algorithms and on-demand schemes for decrypting data while freeing allocated heaps space to evade detection and thwart analysis. The malware is evolving, with the usage of various strings to POST content using forged user agents and various commands and scheduled tasks.QuietSieve – These are heavily obfuscated .NET binaries that act primarily as an infostealer.Who/What is Behind this Attack?According to Microsoft, this latest attack is attributed to the Russian FSB. This is per previous reports by the Ukrainian government linking Gamaredon actors to the FSB.Is this a Widespread Attack?No. According to Microsoft, attacks are limited to targeted attacks in the Ukraine.What is the Status of Coverage?Fortinet customers running the latest definitions are protected by the following AV signatures:MSIL/Pterodo.JJ!trMSIL/Pterodo_AGen.B!trMSIL/Pterodo.JK!trMSIL/Pterodo.JF!trMSIL/Pterodo.JI!trPossibleThreatW32/PossibleThreatVBS/SAgent!trW32/APosT.AUC!trW32/Pterodo.AWR!trW32/APosT!trW32/APosT.AWN!trVBA/Amphitryon.1918!trW32/Pterodo.AVL!trW32/Pterodo.AUZ!trW32/Pterodo.ASQ!trW32/GenKryptik.FGHO!trRiskware/PterodoW32/Pterodo.APR!trW32/Pterodo.AQB!trAll network IOC’s are blocked by the WebFiltering client.Any Other Suggested Mitigation?As ACTINIUM uses spearphishing techniques as an entry point, organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spearphishing attacks. They also need to encourage employees to never open attachments from someone they don’t know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spearphishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations’ internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.
More Stories
USN-7555-3: Django vulnerability
USN-7555-1 fixed a vulnerability in Django. This update provides an additional fix for Ubuntu 18.04 LTS. Original advisory details: It...
spdlog-1.14.1-4.fc41
FEDORA-2025-7d5c7fe0c7 Packages in this update: spdlog-1.14.1-4.fc41 Update description: Backported the upstream CVE-2025-6140 fix. Read More
dotnet8.0-8.0.117-1.fc41
FEDORA-2025-433fb98ceb Packages in this update: dotnet8.0-8.0.117-1.fc41 Update description: This is the June 2025 monthly update for .NET 8. Release Notes:...
dotnet8.0-8.0.117-1.fc42
FEDORA-2025-fa1fdd193f Packages in this update: dotnet8.0-8.0.117-1.fc42 Update description: This is the June 2025 monthly update for .NET 8. Release Notes:...
USN-7571-1: c3p0 vulnerability
Aaron Massey discovered that c3p0 could be made to crash when parsing certain input. An attacker able to modify the...
python-setuptools-69.2.0-10.fc41
FEDORA-2025-1746085e78 Packages in this update: python-setuptools-69.2.0-10.fc41 Update description: Security fix for CVE-2025-47273 Read More