Info operation concentrating on Ukrainian audio system within the context of the struggle

Operation Texonto is a disinformation/PSYOP marketing campaign utilizing spam mails as the primary distribution technique. Surprisingly, it doesn’t appear that the perpetrators used frequent channels comparable to Telegram or pretend web sites to convey their messages. We have now detected two completely different waves, the primary one in November 2023 and the second on the finish of December 2023. The contents of the emails had been about heating interruptions, drug shortages, and meals shortages, that are typical themes of Russian propaganda.

Along with the disinformation marketing campaign, we now have detected a spearphishing marketing campaign that focused a Ukrainian protection firm in October 2023 and an EU company in November 2023. The objective of each was to steal credentials for Microsoft Workplace 365 accounts. Due to similarities within the community infrastructure utilized in these PSYOPs and phishing operations, we’re linking them with excessive confidence.

Staff working at a serious Ukrainian protection firm obtained a phishing electronic mail in October 2023, purportedly coming from their IT division. The emails had been despatched from it.[redacted_company_name]@gmail.com, an electronic mail deal with most definitely created particularly for this marketing campaign, and the e-mail topic was Запрошено утверждение:Планова інвентаризація (machine translation from Ukrainian: Approval requested: Deliberate stock).

The content material of the e-mail is the next:

У період з 02 жовтня по 13 жовтня співробітники відділу інформаційних технологій проводять планову інвентаризацію та видалення поштових скриньок, що не використовуються. Якщо Ви плануєте використовувати свою поштову адресу ([redacted_address]@[redacted_company_name].com) у майбутньому, будь ласка, перейдіть на веб-версію поштової скриньки за цим посиланням та увійдіть до системи, використовуючи свої облікові дані.

 

Жодних додаткових дій не потрібно, Ваша поштова скринька отримає статус “підтверджений” і не буде видалена під час планової інвентаризації ресурсів. Якщо ця поштова адреса не використовується Вами (або її використання не планується в майбутньому), то в цьому випадку Вам не потрібно виконувати жодних дій – поштову скриньку буде видалено автоматично 13 жовтня 2023 року.

 

З повагою,

 

Відділ інформаційних технологій.

A machine translation of the e-mail is:

Within the interval from October 2 to October 13, staff of the data expertise division will conduct a deliberate stock and elimination of unused mailboxes. In case you plan to make use of your electronic mail deal with ([redacted_address]@[redacted_company_name].com) sooner or later, please go to the online model of the mailbox at this hyperlink and log in utilizing your credentials.

 

No further actions are required, your mailbox will obtain the standing “confirmed” and won’t be eliminated throughout a scheduled useful resource stock. If this electronic mail deal with will not be utilized by you (or its use will not be deliberate sooner or later), then on this case you do not want to take any motion – the mailbox shall be deleted robotically on October 13, 2023.

 

Finest regards,

 

Division of data applied sciences.

The objective of the e-mail is to entice targets into clicking on за цим посиланням (machine translation: at this hyperlink), which ends up in https://login.microsoftidonline[.]com/frequent/oauth2/authorize?client_id=[redacted];redirect_uri=httpspercent3apercent2fpercent2foutlook.office365.compercent2fowapercent2f&useful resource=[redacted]&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=[redacted]&protectedtoken=true&claims=%7bpercent22id_tokenpercent22percent3apercent7bpercent22xms_ccpercent22percent3apercent7bpercent22valuespercent22percent3apercent5bpercent22CP1percent22percent5dpercent7dpercent7dpercent7d&domain_hint=[redacted]&nonce=[redacted]&state=[redacted] (partially redacted). This URL factors to the malicious area login.microsoftidon-line[.]com. Word that this area could be very near the official one, login.microsoftonline.com.

We haven’t been in a position to retrieve the phishing web page, however it was most definitely a pretend Microsoft login web page supposed to steal the targets’ credentials.

On November 20^th, we detected the primary wave of disinformation emails with a PDF attachment despatched to at the very least just a few hundred recipients in Ukraine. Folks working on the Ukrainian authorities, power firms, and even people, obtained the emails. We have no idea how the listing of electronic mail addresses was constructed.

Opposite to the beforehand described phishing marketing campaign, the objective of those emails was to sow doubt within the thoughts of Ukrainians; as an illustration, one electronic mail says that “There could also be heating interruptions this winter”. It doesn’t appear there was any malicious hyperlink or malware on this particular wave, solely disinformation.

Determine 2 exhibits an electronic mail instance. Its topic is Рекомендації моз україни на тлі дефіциту ліків (machine translation from Ukrainian: Suggestions of the Ministry of Well being of Ukraine on the time of a scarcity of medicines) and the e-mail was despatched from mozua@ua-minagro[.]com. Word that this deal with might be seen within the envelope-from and return-path fields.

ua-minagro[.]com is a site operated by the attackers and was used completely for sending disinformation emails on this marketing campaign. The area is masquerading because the Ministry of Agrarian Coverage and Meals of Ukraine whose authentic area is minagro.gov.ua.

Connected to the e-mail is a PDF doc, as proven in Determine 3. Whereas it isn’t malicious per se, it additionally comprises disinformation messages.

The doc is misusing the brand of the Ministry of Well being of Ukraine and explains that as a result of struggle, there’s a drug scarcity in Ukraine. It additionally says that the Ukrainian authorities is refusing to import medicine from Russia and Belarus. On the second web page, they clarify the best way to substitute some medicine with crops.

What’s attention-grabbing to notice is that the e-mail was despatched from a site masquerading because the Ministry of Agrarian Coverage and Meals of Ukraine, whereas the content material is about drug shortages and the PDF is misusing the brand of the Ministry of Well being of Ukraine. It’s probably a mistake from the attackers or, at the very least, exhibits they didn’t care about all particulars.

Along with ua-minagro[.]com, 5 further domains had been used to ship emails on this wave:

• uaminagro[.]com
• minuaregion[.]org
• minuaregionbecareful[.]com
• uamtu[.]com
• minagroua[.]org

A couple of month after the primary wave, we detected a second PSYOP electronic mail marketing campaign concentrating on not solely Ukrainians, but additionally individuals in different European international locations. The targets are considerably random, starting from the Ukrainian authorities to an Italian shoe producer. As a result of all of the emails are written in Ukrainian, it’s doubtless that the international targets are Ukrainian audio system. In accordance with ESET telemetry, just a few hundred individuals obtained emails on this second wave.

We discovered two completely different electronic mail templates on this wave. The primary one was despatched on December 25^th and is proven in Determine 6. As for the primary wave, the e-mail messages had been despatched from an electronic mail server operated by the attackers, infoattention[.]com on this case.

A machine translation of the e-mail physique is the next:

Expensive Ukrainians, we congratulate you on the warmest and most household vacation – the New 12 months!

We sincerely need you to have fun 2024 with your loved ones! Could your loved ones and pals by no means get sick! Handle one another! Solely collectively we can drive out the Satanists from the USA and their minions from the unique Russian soil! Let’s revive Kievan Rus despite our enemies! Let’s save individuals’s lives! From Russia with love!

Completely satisfied vacation, pricey pals!

The second electronic mail template, proven in Determine 7, was despatched on December 26^th, 2023 from a unique electronic mail server: stronginfo1[.]com. Throughout this wave, two further electronic mail addresses had been used:

• happyny@infonotifi[.]com
• happyny@infonotification[.]com

A machine translation of the e-mail physique is the next:

Completely satisfied New 12 months, Ukrainian brothers! On New 12 months’s Eve, it is time to bear in mind how good it’s to have two pairs of legs and arms, however when you’ve got misplaced one in every of them, then do not be upset – which means you will not meet a Russian soldier in a trench. And right here if all of your limbs are intact, then we don’t envy you. We suggest slicing or sawing off at the very least one of many 4 your self – a few minutes of ache, however then a contented life!

Completely satisfied New 12 months, Ukrainians! Do not forget that typically one is healthier than two!

Whereas the primary PSYOP electronic mail marketing campaign in November 2023 was quite well-prepared, with specifically created PDF paperwork that had been considerably convincing, this second marketing campaign is quite extra primary and darker in its messaging. The second electronic mail template is especially disturbing, with the attackers suggesting individuals amputate a leg or arm to keep away from army deployment. Total, it has all of the traits of PSYOPs throughout struggle time.

In a fairly stunning twist of occasions, one of many domains used to ship PSYOP emails in December 2023, infonotification[.]com, began getting used to ship Canadian pharmacy spam on January 7^th, 2024.

An instance is offered in Determine 8 and the hyperlink redirects to the pretend Canadian pharmacy web site onlinepharmacycenter[.]com. The spam marketing campaign was reasonably giant (within the lots of of messages at the very least) and other people in lots of international locations obtained such emails.

The emails had been despatched from happyny@infonotification[.]com and this was verified within the electronic mail headers:

Return-Path: <happyny@infonotification[.]com>
Delivered-To: [redacted]
[redacted]
Acquired: from infonotification[.]com ([185.12.14[.]13])
        by [redacted] with esmtps (TLS1.3:TLS_AES_256_GCM_SHA384:256)
        [redacted]
        Solar, 07 Jan 2024 12:39:10 +0000

Whereas we don’t know why the operators of the PSYOP campaigns determined to reuse one in every of their servers to ship pretend pharmacy spam, it’s doubtless that they realized that their infrastructure was detected. Therefore, they might have determined to attempt to monetize the already burnt infrastructure, both for their very own revenue or to fund future espionage operations or PSYOPs. Determine 9 summarizes the hyperlinks between the completely different domains and campaigns.

Conclusion

For the reason that begin of the struggle in Ukraine, Russia-aligned teams comparable to Sandworm have been busy disrupting Ukrainian IT infrastructure utilizing wipers. In current months, we now have noticed an uptick in cyberespionage operations, particularly by the notorious Gamaredon group.

Operation Texonto exhibits yet one more use of applied sciences to attempt to affect the struggle. We discovered just a few typical pretend Microsoft login pages however most significantly, there have been two waves of PSYOPs by way of emails most likely to attempt to affect and demoralize Ukrainian residents with disinformation messages about war-related subjects.