On January 18, 2023, a mass email campaign distributing Remcos RAT malware was carried out on behalf of the Security Service of Ukraine (SSU). Once a device is infected, the malware steals passwords from browsers and MS Outlook (email) and captures keystrokes (keylogger). The email itself asked recipients to submit certain information.
The emails also contained an attachment in the form of a .zip archive, which was the file carrying the malware. The full infection chain: email attach .zip > (.rar1 + .rar2) PWD > .exe1 > get bitbucket_org > .exe2 > 185_70_104_90 & 77_105_132_70 > fingerprint & exfil.
In other words, infection occurs after the EXE files are extracted from the archive onto the computer.
This attack method is not new: threat actors frequently use this mechanism to gain access to computer equipment or data.
To protect yourself, pay attention to the following:
The sender. Carefully check the email domain, for example “@gmail.com”. An email sent from the official resource of a government agency will have a domain like “@…gov.ua”, not “@umail.uz” or any other.
Do not extract archived files onto your computer, and block password-protected attachments and automatic extraction of EXE files.
Poorly written text is another clear sign of a phishing email, which is why we recommend reading the content of such messages carefully.
You should also check the details provided in the email, including addresses, phone numbers, postal codes, and other information.
Finally, be wary of a note in the body of the email stating that the attached file has been scanned by antivirus software. Such a note does not guarantee the attachment is safe, as genuine scan notifications are generated by the system rather than written in the email text.
If you receive such an email or have downloaded its attachment, contact law enforcement immediately.
