Google TAG Ukraine Threat Landscape March 2022

Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.

Mustang Panda has used spearphishing attachments to deliver initial access payloads. Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.

APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.

APT28 has used newly-created Blogspot pages for credential harvesting operations.

APT28 has used compromised email accounts to send credential phishing emails.

APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.