UAC-0056 targets European countries in Russian threat actor.

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

The Governmental Computer Emergency Response Team of Ukraine (CERT-UA) has released an alert about a Russian threat actor UAC-0056 (SaintBear, UNC2589, TA471) delivering malwares using email attachments. UNC2589 is a cyber espionage cluster that has been active since early 2021 and has used a constant set of tactics, techniques, and procedures (TTPs). Its primary emphasis has been on Ukraine and Georgia, although spear phishing have also been found targeting foreign ministries in Western Europe and North America, as well as pharmaceutical businesses and financial sector entities.

The first spear phishing campaign was carried out using spear phishing emails in which the actors have included links to Zip archives containing malicious shortcuts (LNK), as well as attachments in the form of PDF documents, Word documents, JavaScript files, and Control Panel File (CPL) executables. Even Word documents connected to emails have utilized a number of tactics to implant payloads into the machine, including malicious macros, embedded JavaScript, and the exploitation of CVE-2017-11882.The email had a Word document with a malicious JavaScript code attached that would download and install a payload known as SaintBot (a downloader) and OutSteel (a document stealer).

The threat actor was also seen implementing previously unknown collection of activities which revolves around a Python-compiled virus that poses as Ukrainian language translation software, which further deployes Cobalt Strike beacon, GrimPlant, and GraphSteel malware.

The Mitre TTPs used by UAC-0056 are:
TA0001 – Initial Access
TA0003 – Persistence
TA0005 – Defense Evasion
TA0002 – Execution
TA0011 – Command and Control
T1566: Phishing
T1566.001: Phishing: Spearphishing Attachment
T1105: Ingress Tool Transfer
T1112: Modify Registry
T1137.001: Office Application Startup: Office Template Macros
T1203: Exploitation for Client Execution