Ukraine: Russian Intel Used Fake Texts to Steal Credentials

The Security Service of Ukraine (SSU), in collaboration with the U.S. Federal Bureau of Investigation (FBI), revealed a sophisticated, long-running cyber operation orchestrated by Russian intelligence services. This campaign, which began in 2019, aimed to compromise the messaging accounts of Ukrainian government officials, military personnel, politicians, and activists, as well as individuals in Europe and the United States. The primary method involved sending fake support texts designed to trick recipients into revealing their login credentials.

According to the SSU's statement on May 15, 2024, the attackers impersonated various organizations, including government agencies and NGOs, to gain trust. These phishing messages contained malicious links that, when clicked, directed users to fake login pages mimicking legitimate services. The stolen credentials were then used to access sensitive communications and information. The SSU reported that the operation successfully compromised a significant number of accounts, although specific figures were not disclosed.

This operation, dubbed "Ghostwriter" by Ukrainian authorities, is part of a broader pattern of Russian cyber espionage targeting critical infrastructure and government entities. The SSU stated that the intelligence gathered from these compromised accounts was likely used to influence political processes and gather strategic information. The investigation is ongoing, with both Ukrainian and U.S. agencies working to identify all involved actors and mitigate the impact of the breaches.

The SSU emphasized the importance of vigilance against such sophisticated social engineering tactics. They advised individuals to be cautious of unsolicited messages, especially those containing links or requests for personal information, and to verify the authenticity of senders through independent channels. The collaboration between the SSU and the FBI underscores the international nature of these cyber threats and the necessity of cross-border cooperation in combating them.