Latvia blames Russian hacking group for phishing attacks against its MoD

North-eastern European country Latvia has blamed a Russian state-sponsored cyberespionage group, known as Gamaredon, for an attempted phishing attack against its Ministry of Defence (MoD) last week.

Researchers at French security company Sekoia explained that Gamaredon sent spear-phishing emails to the Latvian MoD by posing as officials of the Ukrainian Ministry of Defence. The hackers used the domain name “admou[.]org,” which had previously been associated with the group in attacks meant to steal data and break into networks controlled by Ukraine and its allies.

One of the recipients uploaded the message and attachment to the VirusTotal service for scanning after becoming suspicious of it. The recipient found that the email attachment contained malicious code that, when activated, started a series of procedures meant to aid hackers in stealing information from the intended targets within the Ministry of Defence.

Meanwhile, the Ministry of Defence said the Gamaredon group’s attempted phishing attack against it was unsuccessful. Ukrainian cybersecurity officials described Gamaredon’s attacks as intrusive and audacious and said the group’s main purpose was “to conduct targeted cyber intelligence operations.”

FSB-linked Gamaredon, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and Winterflounder, has been attacking organizations outside of Russia for at least ten years. For instance, it has been reported that Gamaredon hackers tried to hack into a NATO nation’s oil refinery last year. With booby-trapped Word documents, it targeted Ukraine’s military and governmental institutions.