Ukraine warns of attacks aimed at taking over Telegram accounts

Ukraine’s technical security and intelligence service warns of threat actors targeting aimed at gaining access to users’ Telegram accounts.

State Service of Special Communication and Information Protection (SSSCIP) of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts.

The Ukrainian CERT attributes the hacking campaign to threat actors tracked as UAC-0094.

Threat actors are targeting Telegram users by sending Telegram messages with malicious links to the Telegram website in order to gain unauthorized access to the records and transfer a one-time code from SMS.

“The criminals sent messages with malicious links to the Telegram website in order to gain unauthorized access to the records, including the possibility to transfer a one-time code from SMS,” reads the alert published by the SSSCIP of Ukraine. “As a result of such attacks, cybercriminals get session data, a list of contacts, and the history of your Telegram session.”

The Telegram messages alert recipients that a login had been detected from a new device located in Russia and urges the recipients to confirm their accounts by clicking on the embedded link.

The URL points to a phishing page designed to trick victims into entering their phone numbers as well as the one-time passwords sent via SMS. Once obtained the one-time password, threat actors use it to take over the accounts.

“The joint efforts of specialists of the Cyberpolice Department of the National Police of Ukraine and the Governmental Computer Emergency Response Team of Ukraine CERT-UA in order to obtain unauthorized access to the accounts of the said service, including the ability to intercept one-time SMS-code.” reads the alert published by CERT-UA. “As a result of such attacks, attackers steal session data, contact list and correspondence history.”

Ukraine CERT-UA recently published a security advisory to warn of spear-phishing attacks conducted by Russia-linked Armageddon APT (aka Gamaredon, Primitive Bear, Armageddon, Winterflounder, or Iron Tilden) targeting local state organizations. The phishing messages have been sent from “vadim_melnik88@i[.]ua,” the campaign aims at infecting the target systems with malware.

Please vote Security Affairs as best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform  

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Telegram)