Russian hackers hit military mission in Ukraine with info-stealing malware on external drives

Date:
Fri, 11 Apr 2025 11:00:00 +0000

Description:
The GammaSteel infostealer was found on infected devices belonging to a Western military operation in Ukraine.

FULL STORY ======================================================================Symantec
says it found GammaSteel on devices belonging to a military operation in Ukraine GammaSteel is an infostealer built by Russian cyber-outfit Gamaredon Gamaredon is one of many groups on GRU's payroll

A military mission of a Western country, located in Ukraine, was the target
of a Russian cyber-espionage attack according to cybersecurity researchers Symantec, who said they identified an attack that started in February 2025
and likely continued until March.

As per the researchers, the attack started with an infected removable drive. This device contained a malicious .LNK file that triggered an infection chain which resulted in the deployment of GammaSteel.

GammaSteel is an infostealer malware , capable of exfiltrating documents in various formats, such as .DOCX, .PDF, .XLS, .TXT, and more. It was most
likely built and deployed by a Russian state-sponsored threat actor known as Gamaredon (or Shuckworm).

Monitor your credit score with TransUnion starting at $29.95/month

TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnions advanced risk assessment tools.

Preferred partner ( What does this mean? ) View Deal Infected removable drives

Besides stealing files, it can also take screenshots of the infected device, and gather vital information about things like installed antivirus tools , running processes, and more.

Finally, the tool establishes persistence on the compromised endpoints via a new Windows registry entry. The researchers said that the threat actors changed their tactics a bit to better hide the payload.

Symantec did not say whose military mission was compromised, or what kind of information - if any - was stolen in the attack. It is safe to assume that
the attack is part of a broader cyber-war effort since Russia invaded Ukraine more than three years ago.

Russian aggression has shown just how much warfare changed and turned
digital. The digital world became an entire front, with Russian
cyber-infantry targeting communications satellites, government endpoints, electrical substations, and more.

The Ukrainians responded by hacking Russian TV and radio to broadcast
anti-war messages, manipulated a taxi app to send dozens of cars to a single location in Moscow, and leaked gigabytes of data from Russian entities, including the private military Wagner Group.

Gamaredon is just one of many groups actively involved in the war, next to Conti, or Sandworm. All are apparently part of GRU, Russias military intelligence unit.

Via BleepingComputer You might also like One year into Russia's war in Ukraine, "all is not quiet on the cyber front" Take a look at our guide to
the best authenticator app We've rounded up the best password managers



======================================================================
Link to news story: https://www.techradar.com/pro/security/russian-hackers-hit-military-mission-in -ukraine-with-info-stealing-malware-on-external-drives


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)