Kyiv blames Belarus-linked APT UNC1151 for recent cyberattack

Ukrainian government attributes the recent attacks against tens of Ukrainian government websites to Belarusian APT group UNC1151.

The government of Kyiv attributes the defacement of tens of Ukrainian government websites to Belarusian APT group UNC1151, the Reuters agency reported in exclusive. Defaced websites were displaying the following message in Russian, Ukrainian and Polish languages.

“Ukrainian! All your personal data has been sent to a public network. All data on your computer is destroyed and cannot be recovered. All information about you stab (public, fairy tale and wait for the worst. It is for you for your past, the future and the future. For Volhynia, OUN UPA, Galicia, Poland and historical areas.” reads a translation of the message.

In November 2021, Mandiant Threat Intelligence researchers linked the Ghostwriter disinformation campaign (aka UNC1151) to the government of Belarus.

In August 2020, security experts from FireEye uncovered a disinformation campaign aimed at discrediting NATO by spreading fake news content on compromised news websites. According to FireEye, the campaign tracked as GhostWriter, has been ongoing since at least March 2017 and is aligned with Russian security interests.

Unlike other disinformation campaigns, GhostWriter doesn’t spread through social networks, instead, threat actors behind this campaign abused compromised content management systems (CMS) of news websites or spoofed email accounts to disseminate fake news.

Now Serhiy Demedyuk, deputy secretary of the national security and defence council, told Reuters, that the Ukrainian government blamed the UNC1151 APT group. Demedyuk explained that the attacks were carried out to cover for more destructive actions behind the scenes. 

“We believe preliminarily that the group UNC1151 may be involved in this attack,” Demedyuk told Reuters. “This is a cyber-espionage group affiliated with the special services of the Republic of Belarus.” “The defacement of the sites was just a cover for more destructive actions that were taking place behind the scenes and the consequences of which we will feel in the near future.”

The Reuters agency pointed out that Belarus is a close ally of Russia, at this time the office of Belarusian President Alexander Lukashenko did not immediately respond to a request for comment about Demedyuk’s accusation.

Russia’s foreign ministry has denied in the past any involvement in cyberattacks targeting Ukraine.

Demedyuk also added that the ransomware used to encrypt some government servers has many similarities with malware previously attributed to the Russia-linked APT29 group.

“The malicious software used to encrypt some government servers is very similar in its characteristics to that used by the ATP-29 group,” he said. “The group specializes in cyber espionage, which is associated with the Russian special services (Foreign Intelligence Service of the Russian Federation) and which, for its attacks, resorts to recruiting or undercover work of its insiders in the right company,”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, UNC1151)