Now, even the most advanced hackers in Russia are using Clickfix to infect devices

A group of Russian government elites has carried out an attack, known as Clickfix, to destroy the equipment of critical organizations in Ukraine, CERT headquarters has warned.

Click to edit has emerged as an attack technique that attackers, especially money-hungry criminals, have started using in the last year or so. The websites targeted by the attackers display a CAPTCHA that requires the visitor to copy a combination of words and enter it into a terminal. These words contain scripts that, once inside, do malicious things, often by installing malware or leaking sensitive data. CERT of Ukraine he said That Wednesday Sandworma leading group within the GRU, Russia’s military intelligence agency, is now using this method.

“GhettoVibe,” “ScoutCurl,” and many more

The Clickfix attacks began in the spring and have continued into the summer. The campaign has resulted in network disruptions for one organization when a linked device was found to be infected with FreakyPoll, the name of one of the Sandworm malware packages. Ukrainian authorities found 10 websites that contained a PowerShell command as part of a fake CAPTCHA that it said had to be submitted to verify that a real person was behind the device’s keyboard.

Read the full article

Comments

Source link