UAC-0277 Group Launches Extensive Cyberattack
In September 2024, CERT-UA identified more than 100 compromised websites exploited by attackers distributing malicious software via counterfeit 'I'm not a robot' verification prompts. The threat actor known as UAC-0277 is orchestrating a widespread cyber campaign using a technique called ClickFix, which tricks users into executing harmful commands on their devices. To manage their operations, the hackers leverage blockchain platforms Polygon and Ethereum, complicating efforts to track their activities.
Guidance from CERT-UA
The malware is spread through fake Cloudflare protection pages designed to deceive Windows users into copying and running system commands. These fraudulent pop-ups appear no more than twice daily per user, reducing their visibility. Infection results in the installation of the LUNEXSTEALER utility and a malicious browser extension disguised as an office document editor.
With these tools, attackers gain control over victims' devices, enabling them to steal passwords and session data. In response, CERT-UA advises system administrators to take precautionary measures to mitigate this threat:
- Disable the Win+R shortcut for standard user accounts;
- Restrict execution of unverified software packages;
- Enforce whitelists for browser extensions.
Should any hacked websites be discovered, CERT-UA urges immediate reporting to facilitate prompt protective actions and safeguard users' information security.
This incident highlights the growing complexity of cyber threats in today's digital landscape. Attackers continually develop sophisticated methods to deceive users, making it essential for organizations and individuals to follow cybersecurity best practices. Combating such risks requires ongoing vigilance and user education to minimize infection and data breach risks.
As cyber threats continue to evolve, the recent attack on Ukrainian websites using the Psychedelic Stealer illustrates the increasing sophistication of hacking methods. This incident, coupled with the widespread distribution of malware via fake verification prompts, underscores the urgent need for enhanced cybersecurity measures to protect sensitive data and user privacy.