Before the invasion, Russia and some countries of the Commonwealth of Independent States (CIS) were typically excluded from ransomware target lists, most likely due to criminal agents residing in those countries or fearing reprisals. However, in the first quarter of 2022, Russia was the target of the highest percentage of detections (12%) in the ransomware category. This included "lock-screen" variants using the Ukrainian national greeting "Slava Ukraini!" (Glory to Ukraine!).
This is one of the conclusions of the latest edition of the “ESET Threat Report”, covering the first four months of the year, which describes the various cyberattacks linked to the current war in Ukraine that ESET researchers analyzed or helped to mitigate. Among them is the reappearance of the Industroyer malware, which targeted an energy supplier in Ukraine.
Before the intrusion, ESET telemetry recorded a sharp 41% drop in attacks via Remote Desktop Protocol (RDP), which involve accessing the network without direct contact, compared to the previous quarter. This decline in attacks comes two years after a period of steady growth. Among the possible reasons behind this decline, ESET highlights the drop in remote work related to the pandemic, increased awareness among IT departments, and the war, whose disruption and sanctions likely influenced access to and availability of the infrastructure involved in RDP attacks. Despite this, nearly 60% of the RDP attacks recorded in the last quarter originated in Russia.
Additionally, there has been an increase in the number of ransomware attacks and amateur "wipers." Their authors often claim allegiance to one side in the conflict and frame the attacks as personal vendettas.
Unsurprisingly, the war has also been exploited by spam and phishing threat actors. Soon after the invasion on February 24th, scammers began preying on people seeking to support Ukraine, using fictitious charity and fundraising initiatives as bait. On that same day, ESET telemetry detected a large spike in spam detections.
Threats beyond invasion
ESET telemetry also found other threats unrelated to war. Among them, ESET highlights the reappearance of Emotet, a family of banking trojans distributed primarily through email spam campaigns. Emotet detections have increased by more than a hundred compared to the previous quarter. However, Microsoft's decision to disable internet macros by default in Office programs will force Emotet operators to seek new attack routes.
Finally, the ESET Threat Report Q1 2022 reviews the most important research findings of the period. The ESET research team also revealed the abuse of vulnerable kernel drivers, high-impact UEFI vulnerabilities, cryptocurrency malware targeting Android and iOS devices, an as-yet-unattributed campaign deploying DazzleSpy malware on macOS, and campaigns by Mustang Panda, Donot Team, Winnti Group, and the APT group TA410.
