RUSSIA-ALIGNED HACKERS ABUSE VIBER TO TARGET UKRAINIAN MILITARY AND GOVERNMENT

Summary from the TLDR InfoSec newsletter

UAC-0184 (Hive0156), a threat actor aligned with Russia, used the Viber messaging platform to send malicious ZIP files containing LNK files disguised as Office documents to Ukrainian military and government targets. The attack involved multiple stages, including the deployment of Hijack Loader via PowerShell, which employed DLL side-loading and module stomping techniques to bypass detection from major security vendors like Kaspersky, Avast, BitDefender, AVG, Emsisoft, Webroot, and Microsoft. Afterward, it injected Remcos RAT into chime.exe for cyber espionage and data theft. Ukrainian organizations should improve monitoring of messaging platforms beyond email, adopt behavioral detection for Hijack Loader and Remcos RAT, and bolster defenses against social engineering attacks that exploit trusted communication channels.