{"id":51127,"date":"2023-03-22T07:32:10","date_gmt":"2023-03-22T07:32:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/unknown-actors-deploy-malware-to-steal-data-in-occupied-regions-of-ukraine\/"},"modified":"2023-03-22T07:32:10","modified_gmt":"2023-03-22T07:32:10","slug":"unknown-actors-deploy-malware-to-steal-data-in-occupied-regions-of-ukraine","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/unknown-actors-deploy-malware-to-steal-data-in-occupied-regions-of-ukraine\/","title":{"rendered":"Unknown actors deploy malware to steal data in occupied regions of Ukraine"},"content":{"rendered":"

A cyber espionage campaign targeting organizations in Russian-occupied regions of Ukraine is using novel malware to steal data, according to Russia-based infosec software vendor Kaspersky.<\/p>\n

In a report<\/a> published Tuesday, Kaspersky researchers detailed the infections, which use a PowerShell-based backdoor they’ve named “PowerMagic” and a previously unknown framework dubbed “CommonMagic” that can steal files from USB devices, take screenshots every three seconds, and send all of this data back to the attacker.<\/p>\n

Kaspersky says the cyber snoops, which have been active since at least September 2021, don’t share infrastruture, code, or other direct ties to any known advanced persistent threat (APT) groups. However, the victims \u2013 administrative, agricultural and transportation organizations located in the Donetsk, Luhansk and Crimea regions \u2013 and the phishing lures suggest that this campaign is related to the illegal Russian invasion of Ukraine. <\/p>\n