Month: August 2023

Russia has been using sham websites to obtain the personal information of thousands of Ukrainian soldiers and their family members, U.S. defense officials say, in what they believe is an attempt to detain the family members who are living in occupied Ukraine and deport them to Russia.

Two U.S. defense officials say a Russian information warfare unit has created at least two phishing websites, WarTears.org and ForeignCombatants.ru, that are posing as support websites for friends and family members of missing, captured or fallen Ukrainian soldiers.

Petro Yatsenko, spokesman for Ukraine’s Coordination Headquarters for the Treatment of Prisoners of War, confirmed to VOA that the two websites are scams. He said there are dozens of similar phishing websites that try to collect data from the families.

“They exploit the extremely vulnerable relatives and loved ones of missing or captured servicemen … [using] the fact that Russia does not provide Ukraine with information about those they hold in captivity,” Yatsenko told VOA. “Relatives hope that their loved one is not dead but is imprisoned, so they provide their personal data.”

One of the websites, WarTears.org, claims to have records of more than 170,000 Ukrainian soldiers in its database.

U.S. defense officials say they believe that Russia is using the names, phone numbers and addresses of Ukrainians obtained through these sites to determine whether any of the soldiers and their family members are living inside Russian-occupied territories.

Those living in occupied territories can be found, screened, detained and deported to Russia, according to the officials.

“That’s quite alarming,” said retired U.S. Air Force Col. Cedric Leighton, who spent more than two decades as an intelligence officer, “but it also shows the thoroughness of their [Russia’s] data collection capabilities and their willingness to exploit these vulnerabilities.”

Last September, U.S. Ambassador Linda Thomas-Greenfield said estimates from a range of sources, including the Russian government, indicated that Russian authorities have interrogated and forcibly deported between 900,000 and 1.6 million Ukrainians. Russia has denied the claim.

Watch related video by Lesia Bakalets:

Yatsenko said Russia’s FSB, the main successor of the Soviet Union’s KGB security agency, has used the personal information obtained from sites like these to extort information about Ukrainian POWs.

“By providing such information, people may unknowingly worsen the situation of their loved ones who are in captivity,” he said.

Applying personal pressure on people is a “very typical” Russian tactic used since Stalinist times, Leighton said.

“This is a refinement to that. This is definitely taking it to a new level,” he told VOA.

The sites were believed to have been created shortly after Russia invaded Ukraine in February 2022. U.S. defense officials say they became aware of the two sites this summer.

Not all of the phishing sites identified by the Defense Intelligence of Ukraine are from the Russian government, according to Yatsenko. Some of the fake websites are created by fraudsters trying to extort money from Ukrainians in a vulnerable position.

“They promise communication, delivery of parcels, and then engage in blackmail, saying the prisoner will be beaten if relatives don’t send money,” he said. “In 99% of cases, behind these channels are people who have no relation to the prisoners and have zero information about them.”

To find out more information on missing family members, Yatsenko said, Ukrainians should contact only official government sources. The Ukrainian government’s Coordination Headquarters for the Treatment of Prisoners of War can be reached at +38 (044) 390 43 90 or 0 800 300 529, Monday-Friday between the local hours of 0900-1700.
…

Ukrainian troops using Android mobile devices are coming under attack from Russian hackers, who are using a new kind of malware to try to steal information critical to the ongoing counteroffensive.

Cyber officials from the United States, along with counterparts from Australia, Britain, Canada and New Zealand, issued a warning Thursday about the malware, named Infamous Chisel, which aims to scan files, monitor communications and “periodically steal sensitive information.”

The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, describes the new malware as “a collection of components which enable persistent access to an infected Android device … which periodically collates and exfiltrates victim information.”

A CISA report published Thursday shared additional technical details about the Russian campaign, with officials warning the malware could be employed against other targets.

Thursday’s warning reflects “the need for all organizations to keep their Shields Up to detect and mitigate Russian cyber activity, and the importance of continued focus on maintaining operational resilience under all conditions,” said Eric Goldstein, CISA executive assistant director for cybersecurity, in a statement.

According to the report by the U.S. and its allies, the malware is designed to persist on a system by replacing legitimate coding with other coding from outside the system that is not directly attached to the malware itself.

It also said the malware’s components are of “low to medium sophistication and appear to have been developed with little regard to defense evasion or concealment of malicious activity.”

Ukraine’s SBU security agency first discovered the Russian malware earlier in August, saying it was being used to “gain access to the combat data exchange system of the Armed Forces of Ukraine.”

Ukrainian officials said at the time they were able to launch defensive cyber operations to expose and block the Russian efforts.

An SBU investigation determined that Russia was able to launch the malware attack after capturing Ukrainian computer tablets on the battlefield.

Ukraine attributed the attack to a cyber threat actor known as Sandworm, which U.S. and British officials have previously linked to the GRU, Russia’s military intelligence service.
…

A global operation led by the FBI has dismantled one of the most notorious cybercrime tools used to launch ransomware attacks and steal sensitive data.

U.S. law enforcement officials announced on Tuesday that the FBI and its international partners had disrupted the Qakbot infrastructure and seized nearly $9 million in cryptocurrency in illicit profits.

Qakbot, also known as Qbot, was a sophisticated botnet and malware that infected hundreds of thousands of computers around the world, allowing cybercriminals to access and control them remotely.

“The Qakbot malicious code is being deleted from victim computers, preventing it from doing any more harm,” the U.S. Attorney’s Office for the Central District of California said in a statement.

Martin Estrada, the U.S. attorney for the Central District of California, and Don Alway, the FBI assistant director in charge of the Los Angeles field office, announced the operation at a press conference in Los Angeles.

Estrada called the operation “the largest U.S.-led financial and technical disruption of a botnet infrastructure” used by cybercriminals to carry out ransomware, financial fraud, and other cyber-enabled crimes.

“Qakbot was the botnet of choice for some of the most infamous ransomware gangs, but we have now taken it out,” Estrada said.

Law enforcement agencies from France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia took part in the operation, code-named Duck Hunt.

“These actions will prevent an untold number of cyberattacks at all levels, from the compromised personal computer to a catastrophic attack on our critical infrastructure,” Alway said.

As part of the operation, the FBI was able to gain access to the Qakbot infrastructure and identify more than 700,000 infected computers around the world, including more than 200,000 in the United States.

To disrupt the botnet, the FBI first seized the Qakbot servers and command and control system. Agents then rerouted the Qakbot traffic to servers controlled by the FBI. That in turn instructed users of infected computers to download a file created by law enforcement that would uninstall Qakbot malware.
…