Hackers are posing as DTEK employees and sending malicious emails to government agencies

CERT-UA experts have detected a cyberattack on government agencies by the UAC-0050 group. The attackers are sending emails purporting to be from DTEK employees in order to gain covert remote access to computers.

A mass email campaign was detected on October 29. The emails referred to alleged electricity bills and included a link to pay them. 

Clicking on the link downloaded an archive containing a malicious file.

Running the file installed the LiteManager program, which allows remote control of the computer. It was configured to launch automatically with the operating system.

The State Special Communications Service urges users not to open suspicious attachments, not to click on questionable links, and not to enter passwords to unzip unknown archives. They advise checking information about outstanding balances only through official apps and websites of service providers.

Source: State Special Communications Service (CERT-UA)

The “ATB” supermarket chain may have fallen victim to a cyberattack by hackers who claimed to have gained access to the official website’s database and disabled the company’s mobile app. In exchange for not disclosing the stolen information, the hackers issued an ultimatum demanding a payment of $400,000.

In South Korea, Shinhan Bank reported a leak of personal data belonging to approximately 25,000 customers as a result of a cyberattack.

Hackers are disguising malicious resources as websites of Ukrainian Armed Forces units and emergency alert apps.