How Cybercriminals Exploit the Ukraine Crisis Through Fake Donation Drives and Malspam

From the first months of the pandemic to the Russia-Ukraine conflict, criminals have played on public fear and uncertainty to trick and defraud people. That is the argument of Alvin Rodrigues, Field CSO for Asia Pacific at Infoblox. He points to Singapore, where scammers spun false stories about vaccination during the vaccine rollout the year before, luring people into clicking suspicious links and landing on fake pages built to collect personal data.

In Rodrigues's view, people are the weakest point in any organisation, and social engineering has long been a standard criminal tactic. Cybercrime now makes up almost half of all crime in Singapore, and online scams have multiplied. The recent SMS phishing scams aimed at bank customers in Singapore, he says, show that fraudsters will turn any situation into a chance to deceive and steal. He describes several ways Infoblox has seen criminals prey on people's generosity to take their money and credentials.

Malspam delivering Agent Tesla

Among the earliest campaigns to use the crisis as bait were malspam runs. Dressed up as urgent emails about supply chain problems, they tricked recipients into downloading Agent Tesla, a remote access trojan (RAT) sold as malware-as-a-service.

RATs are dangerous because they can do more than steal or change data. Once a device is compromised, Agent Tesla can even take over its core functions. Crucially, victims do not know it is there, so finding and removing it can be hard, antivirus software or not. Agent Tesla is also known to mutate, which makes it a greater threat to organisations of every size.

These campaigns prey on human weakness, and other social engineering attacks may play on fear or curiosity instead. Rodrigues advises people to be cautious about opening unfamiliar or unsolicited email on work and personal devices alike, and to examine unusual attachments before downloading or opening them. For companies, he notes that more than 90% of malware has to touch DNS to get into or out of a network, so DNS security can help security teams hunt threats faster.

Fake crypto donation campaigns

When the crisis broke out in late February, public sympathy swung strongly behind Ukraine. A rush of donation sites appeared, and the Ukrainian government itself asked for cryptocurrency donations on Twitter. Criminals quickly moved to set up fraudulent support campaigns of their own, using concern over the conflict to divert well-meant donations into their own accounts.

DAOs, which use a blockchain for transparency and record-keeping, make the picture murkier. Plenty of them are genuine: UkraineDAO (LOVE) collected more than USD$8m for Ukraine in a month. But Infoblox's continuing analysis of domains has turned up fake DAOs that closely resemble real relief organisations. They have no credible links to anyone and exist to steal cryptocurrency, taking advantage of how anonymous and decentralised crypto donations are.

Rodrigues says these schemes show how hard it is for an ordinary consumer to tell a real campaign from a malicious one. Beyond taking the donation, the criminals can also steal personal information and credit card details, or plant malware.

Staying a step ahead

Attackers will keep changing their methods to stay ahead of whatever defences are in place, so Rodrigues recommends a healthy dose of suspicion towards unexpected emails and text messages and while browsing. Organisations should also increase awareness training so that staff keep networks, browsers and devices free of malware. Anyone donating should think carefully before handing over sensitive payment details, and watch for payment services that may be fraudulent and for redirects to unknown third-party sites.

Unstable geopolitics and a pandemic that has dragged on have opened weaknesses that criminals are keen to use, he concludes, and good cyber hygiene will be central to limiting losses in this ongoing game of cat and mouse.