APT28 campaign against Polish government institutions
May 8, 2024, 5:30 p.m.
Tags
External References
Description
The CERT Polska team is investigating a large-scale malware campaign carried out by the Russian intelligence group APT28, which has been targeting Polish government institutions in the past year and is believed to be linked to the GRU.
Date
Published: May 8, 2024, 3:37 p.m.
Created: May 8, 2024, 3:37 p.m.
Modified: May 8, 2024, 5:30 p.m.
Indicators
fb42a4e0f2dd293fd6e7acb8d67d67698a0ae7685bc5462685acf4c2f73d0b44
f348a0349fdec136c3ac9eaee9b8761da6bd33df82056e4dd792192731675b00
ef67f20ff9184cab46408b27eaf12a5941c9f130be49f1c6ac421b546dac2bac
ee433ddd5988ab7325b92378c6d3cb736ddb7f1bad75b939e8c931f417660129
e826dc4f5c16a1802517881f32f26061a4cbc508c3f7944540a209217078aa11
dfd1f3229f903887f2474f361a26273dc63a6221883e86c5eea2dec9521dc081
e1069c8677d64226f7881e8504ed7a13f79f43f143842ea6c1c8b2cc680ed6c2
d714fff643d53fdd56cf9dcb3bd265e1920c4b5f34a4668b584a0619703d8a3e
ca700d44db08ad2ebd52278a3b303f8c13e44847a507fb317ea5dfb6cc924a76
c968f9dd1f16a435901d2b93a028a0ae2508e943c8f480935a529826deb3dbeb
bab7e81395e1e9ee1680c3bb702c44b1b13ee5e67fa893d765284ae168de8369
b3e60909036c4110eb7e3d8c0b1db5be5c164fcc32056885e4f1afe561341afd
ae4e94c5027998f4ce17343e50b935f448e099a89266f9564bd53a069da2ca9a
9ddf5561562a62961a6fcac1dc49633cb79f5d3c8cc9b95fd9f87e7be70d2d35
949b0bd52a4ed47bc4a342e5a29bff2bcdb0169d2fbf0f052509b65229e19b6e
96766dfbf6c661ee3e9f750696803824a04e58402c66f208835a7acebfab1cfc
939e664afa589272c4920b8463d80757afe5b1abd294cd9e59104c04da023364
85f10d3df079b4db3a83ae3c4620c58a8362df2be449f8ce830d087ab41c7a52
7c6689f591ce2ccd6713df62d5135820f94bdbf2e035ab70e6b3c6746865a898
750948489ed5b92750dc254c47b02eb595c6ffcefded6f9d14c3482a96a6e793
745cfce3e0242d0d5f6765b1f74608e9086d7793b45dbd1747f2d2778dec6587
642315d3091a3dfba6c0ed06f119fc40d21f3d84574b53e045baf8910e1fb38c
5d2675572e092ba9aece8c8d0b9404b3adbd27db1312cd659ba561b86301fe73
5883842c87ca6b59236257e15db983cc88d4948cf0d649455f8f393899673fcc
598a8b918d0d2908a756475aee1e9ffaa57b110d8519014a075668b8b1182990
52b8bfbd9ef8ecfd54e71c74a7131cb7b3cc61ea01bc6ce17cbe7aef14acc948
4f0f9a2076b0fd14124bed08f5fc939bada528e7a8163912a4ad1ec7687029a3
43ff178e428373512b83f85db32f364fc19c9a4ac7317835bd5089915b8727b5
4001498463dc8f8010ef1cc803b67ac434ff26d67d132933a187697aa2e88ef1
38ae06833528db02cb3a315d96ad2a664b732b5620675028a8c5e059e820514f
351f10d7df282afed4558d765aa5018af0711fa4f37fa7eb82716313f4848a2f
34cabc0ff2f216830ffe217e8f8d0fa4b7d3a167576745aba48b7e62f546207b
2bd9591bea6b1f4128e4819e3888b45b193d5a2722672b839ad7ae120bf9af3d
158d49cce44968ddd028b1ef5ebc2a5183a31f05707f9dc699f0c47741be84db
0873a19d278a7a8e8cff2dc2e7edbfddc650d8ea961162a6eb3cb3ea14665983
07e539373177801e3fc5427bf691c0315a23b527d39e756daad6a9fc48e846bc
https://webhook.site/f97bcee0-0d91-4503-a30c-027f1b34820f
https://webhook.site/efb79108-a2b5-4cba-844d-6352bb8fad8c
https://webhook.site/e13d23aa-b6f8-4491-9adc-71f7f8c438df
https://webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4^'^
https://webhook.site/dee016bf-21a2-45dd-86b4-6099747794c4
https://webhook.site/c618ea32-2923-4c12-8151-8d0002b56af0
https://webhook.site/c1112bb3-0e6e-4ba4-abe7-fb31388b47ad
https://webhook.site/bec23763-b8d9-4191-99ba-04a4a163b4de
https://webhook.site/bc349b93-b047-42f8-a421-d45e3ec94dc5
https://webhook.site/b10bd697-1a9f-4ec7-aa2f-1fa84ad916a1
https://webhook.site/9c87649c-220d-425d-8331-ffc8d9b94a38
https://webhook.site/9a9cdaf8-120c-4de9-b17a-d6d8e2796a3b
https://webhook.site/90fea98f-fbdb-4847-be03-409d02a43caf
https://webhook.site/7674f06b-e435-4470-a594-6d59578c552d
https://webhook.site/66ea3bbc-29dc-4ece-b804-71c6ec7b77b6
https://webhook.site/5e4c7949-30a2-4477-9e9b-e8828fc76a1b
https://webhook.site/5a8758c6-5702-4fea-9d5e-4fbdb6dd795f
https://webhook.site/577b82c3-7249-44e9-9353-5eab106fead6
https://webhook.site/5100fcc0-f6be-4b09-8c58-5a8a6706ec4f
https://webhook.site/508da0df-7ec9-420e-b1fe-958fbbe699d1
https://webhook.site/4fe5885c-f2f6-4905-8bc7-aef1a046a134
https://webhook.site/4ba464d9-0675-4a7a-9966-8f84e93290ba
https://webhook.site/3f396db1-2016-4b69-9ec3-ffc417d5f3aa
https://webhook.site/2d07e34c-3dd3-45e8-865c-3888a65ab885
https://webhook.site/1658772a-4de8-4368-a604-980c90b0a1ed
https://webhook.site/127df518-52be-46c5-bbb2-0479f4b9693b
https://webhook.site/0ef0dcf7-f258-4d02-b274-cbf62a2000cf
https://webhook.site/0d2dc90e-2d5e-49f8-8249-d7ab955c387a
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=f97bcee0-0d91-4503-a30c-027f1b34820f
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=efb79108-a2b5-4cba-844d-6352bb8fad8c
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=c1112bb3-0e6e-4ba4-abe7-fb31388b47ad
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=bc349b93-b047-42f8-a421-d45e3ec94dc5
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=5100fcc0-f6be-4b09-8c58-5a8a6706ec4f
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=5e4c7949-30a2-4477-9e9b-e8828fc76a1b
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=508da0df-7ec9-420e-b1fe-958fbbe699d1
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=2d07e34c-3dd3-45e8-865c-3888a65ab885
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=1658772a-4de8-4368-a604-980c90b0a1ed
https://run.mocky.io/v3/87f277a5-a081-4976-8e12-351b6c02a903?q=127df518-52be-46c5-bbb2-0479f4b9693b
Attack Patterns
HEADLACE
T1557
T1102
T1204
T1566
Additional Informations
Defence
Military
Defense
Government
Critical Infrastructure