By James Pearson
LONDON (Reuters) – An unidentified state actor is targeting European officials with malicious software in an apparent attempt to try and disrupt efforts to assist Ukrainian refugees, cybersecurity firm Proofpoint said on Wednesday.
Proofpoint did not identify the nation state behind the attack, but noted it was anecdotally similar to campaigns carried out by a hacking group dubbed Ghostwriter – also known as TA445 or UNC1151 – which has previously been identified as working in the interests of Belarus.
“Proofpoint has identified a likely nation state sponsored phishing campaign using a possibly compromised Ukrainian armed service member’s email account to target European government personnel involved in managing the logistics of refugees fleeing Ukraine,” researchers at Proofpoint said in a post on the firm’s website.
Belarus’ embassy in London did not immediately respond to an emailed request for comment.
Thousands of people fleeing fierce fighting in Ukraine have streamed across central European border crossings as Russian troops bombard Ukrainian cities and appear poised to advance on the embattled capital, Kyiv.
Last Friday, Ukrainian cybersecurity officials said Belarusian military hackers were targeting the private email addresses of Ukrainian military personnel “and related individuals”.
The campaign targeting European officials could be the next stage of these attacks, Proofpoint researchers said.
It may also be an attempt to “gain intelligence regarding the logistics surrounding the movement of funds, supplies, and people within NATO member countries,” they added.
“While the utilised techniques in this campaign are not ground-breaking individually, if deployed collectively, and during a high tempo conflict, they possess the capability to be quite effective,” the researchers said.
The United Nations estimates that close to 700,000 people have fled to neighbouring countries since the start of what Russia calls a “special operation” in Ukraine. The UN Refugee Agency has warned the current exodus looks set to become Europe’s largest refugee crisis this century.
(Reporting by James Pearson; Editing by Kirsten Donovan)
