Russian threat actor UAC-0056 targets European countries

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

The Governmental Computer Emergency Response Team of Ukraine (CERT-UA) has released an alert about a Russian threat actor UAC-0056 (SaintBear, UNC2589, TA471) delivering malwares using email attachments. UNC2589 is a cyber espionage cluster that has been active since early 2021 and has used a constant set of tactics, techniques, and procedures (TTPs). Its primary emphasis has been on Ukraine and Georgia, although spear phishing have also been found targeting foreign ministries in Western Europe and North America, as well as pharmaceutical businesses and financial sector entities.

The first spear phishing campaign was carried out using spear phishing emails in which the actors have included links to Zip archives containing malicious shortcuts (LNK), as well as attachments in the form of PDF documents, Word documents, JavaScript files, and Control Panel File (CPL) executables. Even Word documents connected to emails have utilized a number of tactics to implant payloads into the machine, including malicious macros, embedded JavaScript, and the exploitation of CVE-2017-11882.The email had a Word document with a malicious JavaScript code attached that would download and install a payload known as SaintBot (a downloader) and OutSteel (a document stealer).

The threat actor was also seen implementing previously unknown collection of activities which revolves around a Python-compiled virus that poses as Ukrainian language translation software, which further deployes Cobalt Strike beacon, GrimPlant, and GraphSteel malware.

The Mitre TTPs used by UAC-0056 are:TA0001 – Initial AccessTA0003 – PersistenceTA0005 – Defense EvasionTA0002 – ExecutionTA0011 – Command and ControlT1566: PhishingT1566.001: Phishing: Spearphishing AttachmentT1105: Ingress Tool TransferT1112: Modify RegistryT1137.001: Office Application Startup: Office Template MacrosT1203: Exploitation for Client Execution

Actor Details

Vulnerability Details

Indicators of Compromise (IoCs)

Patch Link

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-11882

References

https://cert.gov.ua/article/18419

https://cert.gov.ua/article/37704