As Ukraine fights for survival against invading Russian forces, here's a taste of some of the malware the nation's Computer Emergency Response Team (CERT) is battling.
To start, the team earlier this month
said miscreants had spammed out emails impersonating government agencies containing links to fake Windows antivirus updates. When these were downloaded and run by a victim, more malware was brought onto the machine, including Cobalt Strike Beacon, which can take over the PC with PowerShell scripts, log keystrokes, take screenshots, exfiltrate files, run other malicious code, attempt to traverse the network, and so on. Beacon is a legit tool developed by HelpSystems mainly for red-team professionals.
According to Ukraine's CERT, the emails appeared to come from Ukrainian government agencies, and outlined ways to improve network security. They also told the recipient to download critical security updates in the form of a 60MB executable file dubbed BitdefenderWindowsUpdatePackage.exe. The actual antivirus maker Bitdefender has, to be clear, nothing to do with this.