Why cybercrime is predicted to cost the world $10.5 trillion annually by 2025

Check out our Threat Intelligence module at the bottom of this newsletter.

Phishing Campaigns Pick-Up in the Wake of the Ukraine Invasion

• We’ve seen an upward trend in the number of suspicious emails being flagged related to Ukraine.
• Spam campaigns started to appear only one day after the initial invasion by Russia.
• The number of new domains containing “Ukraine” registered in 2022 is up 210% from 2021.
• An average of 315 new Ukraine themed domains have been observed per day since the 24th February.
  • 77% of these domains appear to be suspicious based on early indicators.

Overview

The conflict taking place in Ukraine has quickly become a common theme for threat actors and scammers alike. We have observed an upward trend in Ukraine themed emails flagged by our platform, including a number of threat campaigns that are exploiting the conflict as a theme for new scams, malspam, and phishing.

In line with this, open source intelligence shows a significant increase in the number of Ukraine themed domains being registered, which can be used for malicious purposes.

The scams observed typically request donations in the form of crypto-currency under the pretense of supporting the Ukrainian humanitarian effort in the wake of the Russian invasion. The spam is similar to common campaigns previously observed, pushing links to suspicious e-commerce sites selling Ukrainian themed items.

 

Domain registrations

There has been a significant upward trend in the number of new domains being registered that contain “Ukraine”. The number of these domains being registered is up more than 210% in 2022, compared to 2021.

Researching domain registrations, we can see the upward trend progressing over the past two months.

Since early March there has been an average of 340 new domains registered each day, either containing “Ukraine” or closely resembling the word.

Our platform observed an upward initial trend in Ukraine themed emails, which peaked early March. This included the spam campaigns and donation scams.

 

Donation Scams

Donations from around the world have been made in support of Ukraine in the wake of the Russian invasion. Unfortunately, leveraging humanitarian efforts such as the one currently underway in Ukraine to perpetrate phishing-related fraud has become a common modus operandi for threat actors and fraudsters.

This explains why phishing remains among the top reported cybersecurity incidents according to the FBI’s latest Internet Crime Report, with over 323k reported incidents for 2021.

The donation scams vary in sophistication from basic emails containing a short message with a plea for help, to fake websites set up to impersonate certain charitable organizations like the British Red Cross.

One of these scam emails claims to be supporting the humanitarian aid effort in Ukraine and is requesting Bitcoin cryptocurrency donations. Legitimate website text and logos from the likes of UNICEF, Actalliance and the Australian Council for International Affairs (ACFID) are being fraudulently leveraged to enhance the authenticity of the phishing emails.

The threat campaign detailed below purporting to be a legitimate humanitarian aid effort for Ukraine from the ACFID, requests Bitcoin donations and allows victims to make the donation via direct Bitcoin address or via a malicious QR code.

Phishing email purporting to be from the ACFID

 

Phishing Bitcoin donation scam

 Malicious QR code to donate Bitcoin

Scanning the QR code with the iOS camera app will prompt you to open a locally installed payment app that supports Bitcoin. In this case, Cash App.

According to Blockchain Explorer, the last transaction to take place with the address in this email was on 2022-02-14 with only 6 transactions in total.

Another donation scam was sent from a newly registered domain redcrossukraine[.]org impersonating the Red Cross in Ukraine. The email contained a link to a professional looking website containing details of the Ukraine conflict as well as instructions on how to donate cryptocurrency in aid of Ukraine.

 

Ukraine themed spam

Spammers have also quickly reacted to the invasion of Ukraine by adjusting the themes of their campaigns.

One notable spam campaign, only a day after the initial invasion, began blasting out spam with links to suspicious e-commerce sites pushing the sale of t-shirts and other items to show support for Ukraine.

The emails sent out in the campaign have subjects like “I Stand With Ukraine Shirts” and contain images of t-shirts with slogans in support of Ukraine. The emails also contain links pointing to sites like mimoprint[.]info or mabil-store[.]com where you can browse and purchase some of the products referenced in the email.

Links resolving to recently created sites like mimoprint[.]info or mabil-store[.]com were sent out in emails with subjects like “I Stand With Ukraine Shirts”. Searching this site online reveals some reviews claiming that they are a scam and if a purchase is made then no product is received. Other reviews claim they steal designs from users on other sites.

 

Recommended action 

•  Some charities do and are accepting cryptocurrency donations. But be cautious of any emails purporting to aid or receive donations in an effort to support the humanitarian effort in Ukraine. If cryptocurrency is requested from an unsolicited email, then the likelihood is that it is a scam.
• Before interacting with any Ukrainian themed email received, check the source and email header to confirm the organization it originated from is legitimate.

 

Contact us today for comprehensive support and services.

 

 

 

Posted on: May 2, 2022, by : Moe