Ukr.net is widely used for phishing – hackers fake the news aggregator

In July, the activity of cybercriminals hunting for personal data of citizens increased significantly in Ukraine. One of the hackers’ methods was the creation of a fake ukr.net site.

The government’s computer emergency response center CERT-UA recorded an increase in attacks by the UAC-0102 group. The main goal of attackers is to steal ukr.net accounts. Hackers are interested in the data of tax officials, employees of government agencies, the military and employees of various enterprises.

One of the most common attack methods is to send emails with attached HTML files imitating web pages. Hackers use less security of public mail services compared to corporate ones.

When the victim opens the attachment, he is redirected to a phishing site that looks similar to the ukr.net page. Entered logins, passwords and other data are transmitted to attackers.

CERT-UA gave advice for protection against attacks:

• Enable two-factor authentication where possible.
• Avoidance of using public mail from company computers and networks.
• Funds for forwarding letters to more secure corporate mail.