Emerging Cyber Threats to Ukrainian Government Entities

The landscape of cyber incidents in Ukraine is evolving, as CERT-UA has reported a new wave of targeted cyberattacks against government agencies and defense industry enterprises.

According to the State Special Communications Service, the group UAC-0099 has enhanced its methods and is now employing new malware, including MATCHBOIL, MATCHWOK, and DRAGSTARE. The attackers implement multi-stage operations aimed at data theft and remote control of systems.

The attack typically begins with phishing emails, often disguised as official documents like court summons. These emails contain links to legitimate file-sharing services, and clicking on them initiates the download of a ZIP archive that holds a malicious HTA file, marking the start of the attack.

Upon execution, the HTA file runs VBScript, which creates two files on the victim's computer: one containing HEX-encoded data and the other containing PowerShell code. To ensure the execution of this code, a scheduled task is created. The next step involves a PowerShell script decoding the data and forming an executable MATCHBOIL loader, which embeds itself into the system through its own scheduled task.

The primary targets of this group are Ukrainian government agencies, defense forces, and enterprises operating within the defense sector.

CERT-UA's research has uncovered three new samples of malware, indicating an evolution in the group's tactics.

MATCHBOIL (Loader) is designed to deliver the primary malicious payload to the compromised computer. It gathers basic system information to identify the victim on the command server and subsequently downloads the next attack component, saving it as a COM file.

MATCHWOK (Backdoor) allows attackers to remotely execute arbitrary PowerShell commands on the infected system, with commands received from the command server in encrypted form.

DRAGSTARE (Data Stealer) performs comprehensive data collection, including system information, browser data, and files with extensions .docx, .pdf, .txt.

Recommendations from CERT-UA

To counter these threats, it is essential to:

• Enhance control over incoming correspondence and train employees to identify phishing attempts.
• Restrict script execution and configure security policies accordingly.
• Implement endpoint monitoring (EDR).
• Ensure network perimeter protection using IDS/IPS systems.
• Keep software up to date.