Hive0117 is currently classified as a financially motivated threat group employing moderately sophisticated strategies. It is likely that the telecommunications and other industry targets are intended to create a foundation for further compromise of companies and government organizations both local to the current region of operations in Eastern Europe and also global in scope. For example, subsidiaries of international companies in Eastern Europe can be compromised in order to compromise the parent company or sister subsidiaries elsewhere. Moreover, such compromise may extend to end clients and corporate partners as well.

In the current threat environment, attacks by financially motivated threat groups have an elevated likelihood in many organization’s threat models, particularly those that provide essential infrastructure services who may pay for data extortion and ransom. Supply chain attacks have been documented as a favored method of evading defensive controls and mitigations: by installing backdoors into trusted software or hardware, threat groups with the appropriate resources gain the ability to evade perimeter defenses. In addition, other trusted relationships such as counterparties, suppliers, contracted vendors, et al., are also at risk for Business Email Compromise (BEC) and other attempts to take advantage of trusted access. For this reason, smaller organizations are also at elevated risk as potential stepping-stones for compromising larger organizations. Organizations are advised to adopt increased vigilance and move toward zero-trust methodologies, as well as investing in comprehensive defense-in-depth and post-exploitation detection strategies – such as those offered by Binary Defense.

https://www.bleepingcomputer.com/news/security/russian-govt-impersonators-target-telcos-in-phishing-attacks/

Hive0117 Continues Fileless Malware Delivery in Eastern Europe