FortiGuard Labs is aware that a copy of Remote Manipulator System (RMS) was submitted from Ukraine to VirusTotal on February 28th, 2022. The RMS is a legitimate remote administration tool that allows a user to remotely control another computer. The file name is in Ukrainian and is “Evacuation Plan (approved by the SSU on 28.02.2022 by Order No. 009363677833).exe” in translation to English. The SSU likely stands for the Security Service of Ukraine. Why is this Significant?This is significant because given its file name, the country where the file was submitted to VirusTotal and the current situation in Ukraine, the file may have been distributed to Ukrainians.What does the File Do?The file silently installs a copy of legitimate Remote Utilities software to the compromised machine. The software allows a remote user to control the compromised machine.Based on the telemetry FortiGuard Labs collected, there is one IP address in Ukraine that connected to the remote IP that likely belongs to the attacker. How was the File Distributed to the Targets?Most likely via links in email.CERT-UA published a warning today that “the representatives of the Center for Combating Disinformation began to receive requests for information from the mail of the Ukrainian Security Service. Such notifications are fake and are a cyberattack”. The email below is reported have been used in the attack.Machine translation:Email subject: Evacuation plan from: SBU (Urgent) -28.02.2022 day off: 534161WARNING! This is an external sheet: do not click on the links or open a tab if you do not trust the editor.Report a suspicious list to ib@gng.com.ua.Security Service of UkraineGood afternoon, you need to have acquainted with the electronic evacuation plan until 01.03.2022, to give data on the number of employees, fill in the document in accordance with Form 1980-22SBU-98.To ensure confidentiality of the transferred data, the password: 2267903645 is set on the deposit.See the document on:hxxps://mega.nz/file/[reducted]Mirror 2: hxxps://files.dp.ua/en/[reducted]Mirror 3: hxxps://dropmefiles.com/[reducted]While the remote files were not available at the time of the investigation, the email and “Evacuation Plan (approved by the SSU on 28.02.2022 by Order No. 009363677833).exe” are likely connected based on the email content and the file name. Can the File Attributed to a Particular Threat Actor?It’s possible that a threat actor distributed the file to target Ukraine. However, while the Remote Utilities software is silently installed on the compromised machine, it displays an icon in Windows’s taskbar. Since most threat actors aim to hide their activities, this is potentially an act of novice attacker who tries to take advantage of the current situation in Ukraine.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against the files involved in this attack:Riskware/RemoteAdmin_RemoteUtilities
More Stories
USN-5965-1: TigerVNC vulnerability
It was discovered that TigerVNC mishandled TLS certificate exceptions. An attacker could use this vulnerability to impersonate any server after...
CVE-2012-10009
A vulnerability was found in 404like Plugin up to 1.0.2. It has been classified as critical. Affected is the function...
AndroxGh0st Malware Actively Used in the Wild
FortiGuard Labs is aware that AndroxGh0st malware is actively used in the field to primarily target .env files that contain...
#StopRansomware: LockBit 3.0 (AA23-075A)
On March 16th, 2023, CISA, FBI and MS-ISAC released a joint advisory on LockBit 3.0 ransomware as part of #StopRansomware...
stellarium-1.2-9.fc37
FEDORA-2023-2cf272ad72 Packages in this update: stellarium-1.2-9.fc37 Update description: Patches for CVE-2023-28371 Read More
stellarium-1.2-9.fc36
FEDORA-2023-b7e90bc682 Packages in this update: stellarium-1.2-9.fc36 Update description: Patches for CVE-2023-28371 Read More