Ukrainian separatists targeted in cyber espionage attack
Security firm, Eset, has discovered a surveillance operation against Eastern Ukrainian separatists. The campaign used Win32/Prikormka malware, which until now was unknown, and allows the attacker to steal sensitive information and files. Researchers have determined that this particular malware has been in use since at least 2008, and has been used in cyber espionage activities targeting separatists in the Donetsk and Luhansk People's Republics. Alongside these individuals, Ukrainian government officials, politicians and journalists, as well as peacekeeping and monitoring organisations, have also been targeted. Researchers have said that the infection vector used is likely to have been spear-phishing emails.

Researchers at security firm Eset have uncovered an ongoing surveillance operation against separatists in Eastern Ukraine using previously unknown malware.

Detected as Win32/Prikormka, the malware has eluded the attention of antimalware researchers since at least 2008. It has been carrying out cyber-espionage activities primarily targeting anti-government separatists in the self-declared Donetsk and Luhansk People's Republics.

The malware features a modular architecture, allowing attackers to expand its functionality and steal various types of sensitive information and files from the cyber-surveillance targets, the researchers said.

Further technical details of the malware, as well as additional information on the ongoing cyberespionage operation, can be found in Eset’s comprehensive whitepaper.

“Along with the armed conflict in the east of Ukraine, the country has been encountering numerous targeted cyberattacks, or so-called advanced persistent threats,” said Robert Lipovský, senior malware researcher at Eset.

“For example, we discovered several campaigns using the now-infamous BlackEnergy malware family, one of which resulted in a massive power outage. But in the survellance operation, previously unknown malware is used,” he said.