Information operation targeting Ukrainian speakers in the context of the war

Operation Texonto is a disinformation/PSYOP campaign using spam mails as the main distribution method. Surprisingly, it doesn’t seem that the perpetrators used common channels such as Telegram or fake websites to convey their messages. We have detected two different waves, the first one in November 2023 and the second one at the end of December 2023. The contents of the emails were about heating interruptions, drug shortages, and food shortages, which are typical themes of Russian propaganda.

In addition to the disinformation campaign, we have detected a spearphishing campaign that targeted a Ukrainian defense company in October 2023 and an EU agency in November 2023. The goal of both was to steal credentials for Microsoft Office 365 accounts. Thanks to similarities in the network infrastructure used in these PSYOPs and phishing operations, we are linking them with high confidence.

Employees working at a major Ukrainian defense company received a phishing email in October 2023, purportedly coming from their IT department. The emails were sent from it.[redacted_company_name]@gmail.com, an email address most likely created specifically for this campaign, and the email subject was Запрошено утверждение:Планова інвентаризація (machine translation from Ukrainian: Approval requested: Planned inventory).

The content of the email is the following:

У період з 02 жовтня по 13 жовтня співробітники відділу інформаційних технологій проводять планову інвентаризацію та видалення поштових скриньок, що не використовуються. Якщо Ви плануєте використовувати свою поштову адресу ([redacted_address]@[redacted_company_name].com) у майбутньому, будь ласка, перейдіть на веб-версію поштової скриньки за цим посиланням та увійдіть до системи, використовуючи свої облікові дані.

 

Жодних додаткових дій не потрібно, Ваша поштова скринька отримає статус “підтверджений” і не буде видалена під час планової інвентаризації ресурсів. Якщо ця поштова адреса не використовується Вами (або її використання не планується в майбутньому), то в цьому випадку Вам не потрібно виконувати жодних дій – поштову скриньку буде видалено автоматично 13 жовтня 2023 року.

 

З повагою,

 

Відділ інформаційних технологій.

A machine translation of the email is:

In the period from October 2 to October 13, employees of the information technology department will conduct a planned inventory and removal of unused mailboxes. If you plan to use your email address ([redacted_address]@[redacted_company_name].com) in the future, please go to the web version of the mailbox at this link and log in using your credentials.

 

No additional actions are required, your mailbox will receive the status “confirmed” and will not be removed during a scheduled resource inventory. If this email address is not used by you (or its use is not planned in the future), then in this case you do not need to take any action – the mailbox will be deleted automatically on October 13, 2023.

 

Best regards,

 

Department of information technologies.

The goal of the email is to entice targets into clicking on за цим посиланням (machine translation: at this link), which leads to https://login.microsoftidonline[.]com/common/oauth2/authorize?client_id=[redacted];redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=[redacted]&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=[redacted]&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&domain_hint=[redacted]&nonce=[redacted]&state=[redacted] (partially redacted). This URL points to the malicious domain login.microsoftidonline[.]com. Note that this domain is very close to the official one, login.microsoftonline.com.

We haven’t been able to retrieve the phishing page, but it was most likely a fake Microsoft login page intended to steal the targets’ credentials.

On November 20^th, we detected the first wave of disinformation emails with a PDF attachment sent to at least a few hundred recipients in Ukraine. People working at the Ukrainian government, energy companies, and even individuals, received the emails. We do not know how the list of email addresses was built.

Contrary to the previously described phishing campaign, the goal of these emails was to sow doubt in the mind of Ukrainians; for instance, one email says that “There may be heating interruptions this winter”. It doesn’t seem there was any malicious link or malware in this specific wave, only disinformation.

Figure 2 shows an email example. Its subject is Рекомендації моз україни на тлі дефіциту ліків (machine translation from Ukrainian: Recommendations of the Ministry of Health of Ukraine at the time of a shortage of medicines) and the email was sent from mozua@ua-minagro[.]com. Note that this address can be seen in the envelope-from and return-path fields.

ua-minagro[.]com is a domain operated by the attackers and was used exclusively for sending disinformation emails in this campaign. The domain is masquerading as the Ministry of Agrarian Policy and Food of Ukraine whose legitimate domain is minagro.gov.ua.

Attached to the email is a PDF document, as shown in Figure 3. While it is not malicious per se, it also contains disinformation messages.

The document is misusing the logo of the Ministry of Health of Ukraine and explains that due to the war, there is a drug shortage in Ukraine. It also says that the Ukrainian government is refusing to import drugs from Russia and Belarus. On the second page, they explain how to replace some drugs with plants.

What’s interesting to note is that the email was sent from a domain masquerading as the Ministry of Agrarian Policy and Food of Ukraine, while the content is about drug shortages and the PDF is misusing the logo of the Ministry of Health of Ukraine. It is possibly a mistake from the attackers or, at least, shows they did not care about all details.

In addition to ua-minagro[.]com, five additional domains were used to send emails in this wave:

• uaminagro[.]com
• minuaregion[.]org
• minuaregionbecareful[.]com
• uamtu[.]com
• minagroua[.]org

About a month after the first wave, we detected a second PSYOP email campaign targeting not only Ukrainians, but also people in other European countries. The targets are somewhat random, ranging from the Ukrainian government to an Italian shoe manufacturer. Because all the emails are written in Ukrainian, it is likely that the foreign targets are Ukrainian speakers. According to ESET telemetry, a few hundred people received emails in this second wave.

We found two different email templates in this wave. The first one was sent on December 25^th and is shown in Figure 6. As for the first wave, the email messages were sent from an email server operated by the attackers, infoattention[.]com in this case.

A machine translation of the email body is the following:

Dear Ukrainians, we congratulate you on the warmest and most family holiday – the New Year!

We sincerely want you to celebrate 2024 with your family! May your family and friends never get sick! Take care of each other! Only together we will be able to drive out the Satanists from the USA and their minions from the original Russian soil! Let’s revive Kievan Rus in spite of our enemies! Let’s save people’s lives! From Russia with love!

Happy holiday, dear friends!

The second email template, shown in Figure 7, was sent on December 26^th, 2023 from a different email server: stronginfo1[.]com. During this wave, two additional email addresses were used:

• happyny@infonotifi[.]com
• happyny@infonotification[.]com

A machine translation of the email body is the following:

Happy New Year, Ukrainian brothers! On New Year’s Eve, it’s time to remember how good it is to have two pairs of legs and arms, but if you have lost one of them, then don’t be upset – this means that you won’t meet a Russian soldier in a trench. And here if all your limbs are intact, then we do not envy you. We recommend cutting or sawing off at least one of the four yourself – a couple of minutes of pain, but then a happy life!

Happy New Year, Ukrainians! Remember that sometimes one is better than two!

While the first PSYOP email campaign in November 2023 was rather well-prepared, with specially created PDF documents that were somewhat convincing, this second campaign is rather more basic and darker in its messaging. The second email template is particularly disturbing, with the attackers suggesting people amputate a leg or arm to avoid military deployment. Overall, it has all the characteristics of PSYOPs during war time.

In a quite surprising twist of events, one of the domains used to send PSYOP emails in December 2023, infonotification[.]com, started being used to send Canadian pharmacy spam on January 7^th, 2024.

An example is provided in Figure 8 and the link redirects to the fake Canadian pharmacy website onlinepharmacycenter[.]com. The spam campaign was moderately large (in the hundreds of messages at least) and people in many countries received such emails.

The emails were sent from happyny@infonotification[.]com and this was verified in the email headers:

Return-Path: <happyny@infonotification[.]com>
Delivered-To: [redacted]
[redacted]
Received: from infonotification[.]com ([185.12.14[.]13])
        by [redacted] with esmtps (TLS1.3:TLS_AES_256_GCM_SHA384:256)
        [redacted]
        Sun, 07 Jan 2024 12:39:10 +0000

While we don’t know why the operators of the PSYOP campaigns decided to reuse one of their servers to send fake pharmacy spam, it is likely that they realized that their infrastructure was detected. Hence, they may have decided to try to monetize the already burnt infrastructure, either for their own profit or to fund future espionage operations or PSYOPs. Figure 9 summarizes the links between the different domains and campaigns.

Conclusion

Since the start of the war in Ukraine, Russia-aligned groups such as Sandworm have been busy disrupting Ukrainian IT infrastructure using wipers. In recent months, we have observed an uptick in cyberespionage operations, especially by the infamous Gamaredon group.

Operation Texonto shows yet another use of technologies to try to influence the war. We found a few typical fake Microsoft login pages but most importantly, there were two waves of PSYOPs via emails probably to try to influence and demoralize Ukrainian citizens with disinformation messages about war-related topics.