State Service of Special Communication and Information Protection of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts. The Ukrainian CERT attributes the hacking campaign to threat actors tracked as UAC-0094. Threat actors are targeting Telegram users by sending Telegram messages with malicious links to the Telegram website in order to gain unauthorized access to the records and transfer a one-time code from SMS.
Executive Summary
The threat actor UAC-0094 is targeting Telegram users through phishing attacks, aiming to steal SMS-based one-time codes for potential financial gain or espionage.
Goals & Targeting
UAC-0094 likely targets individuals and possibly businesses using Telegram in Ukraine and potentially other regions. Their primary goals appear to include financial gain through identity theft or fraud, with possible secondary objectives such as espionage if targeting specific groups or sensitive information.
Enhanced Description
UAC-0094 has been identified by the Ukrainian CERT as a cyber actor conducting campaigns that exploit Telegram vulnerabilities. The group sends malicious links via Telegram messages, directing users to fake websites to compromise their accounts and intercept SMS codes. This tactic indicates a focus on individual or small-scale targets rather than large organizations, although the broader impact could extend beyond Ukraine.
Key Capabilities
MITRE ATT&CK Tactics
ATT&CK Techniques
Software / Tooling
Campaigns & Victims
UAC-0094's campaigns exhibit consistent targeting of Telegram users, likely individuals and small businesses. Their operational tempo is steady but not widely documented beyond the initial reports.
IOC Patterns
Recommended Actions
Suggested Tags
Confidence Assessment
Low confidence due to limited details on UAC-0094's full capabilities and past campaigns outside of the described phishing activities. More data would enhance understanding.
No techniques linked yet.
No tools linked yet.
No campaigns linked yet.
No observed data linked yet.
No IOCs linked yet.
No references recorded yet.
0
Techniques
0
Tools
0
Campaigns
0
IOCs
0
Observed Data
0
Tactics