Russia Maintains its Sights on Ukraine

Russia continues to apply pressure on Ukraine through various cyber operations, including disruptive attacks, espionage campaigns, and the dissemination of misinformation. Additionally, destructive data-wiping attacks have been observed. A first-quarter report released by Google’s Threat Analysis Group (TAG) focuses on campaigns initiated by the Russian threat group APT28. "In the first quarter of 2023, Russian government-backed phishing campaigns targeted users in Ukraine, with the country accounting for over 60% of observed Russian targeting," said Google TAG. With its vast array of capabilities, APT28 is focused on targeting industries in "government, defense, energy, transportation/logistics, education and humanitarian" for cyberespionage operations. Google TAG observed the actors distributing phishing links through emails and SMS to distribute information-stealing malware. Users on Telegram were also targeted to obtain their account credentials, and "users following pro-Russia channels," were also in the scope of the attack.