Hackers target Ukraine’s Delta Military Intelligence Program

The Ukrainian military has alerted the national cybersecurity response team to a phishing campaign whose operators plan to steal files and siphon internet browser data.

According to CERT-UA (Computer Emergency Response Team of Ukraine), the attackers utilised hacked email accounts belonging to Ministry of Defense employees, as well as chat apps, to send out messages informing recipients about the need to update Delta system certificates. The malicious emails include documents with links to archive files hosted on a fake Delta domain.

The email in question contains a malicious PDF attachment with instructions on how to do so, as well as a link to a malicious ZIP archive.

If a recipient clicks on the link, a “” archive containing the “certificates_rootCA.exe” executable file protected by VMProtect will be downloaded to their computer, CERT-UA said.

“After running the exe file, several DLL files, also protected by VMProtect, and an ‘ais.exe’ file simulating the certificate installation process will be created on the PC,” it added.

According to CERT-UA, the executable contained in the malicious zip file that users were urged to download from the site was also compiled and digitally signed. It ran an application simulating the certificate installation process on a Windows desktop to make the infection process appear legitimate.

Two malicious applications were launched by the malware. One, dubbed “FateGrab” by CERT-UA, searched for files associated with documents, such as Microsoft Office file extensions, as well as files such as stored PowerShell commands or script files. FTP was the threat actor’s method of exfiltration.

The sources for this piece include an article in BleepingComputer.

IT World Canada Staff
IT World Canada Staff
The online resource for Canadian Information Technology professionals.

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

ITW in your inbox

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

More Best of The Web