Cybercriminals are targeting Ukrainian government entities with fake emails pretending to be from the National Police of Ukraine. The attacks use malicious SVG files that look like official legal notices, warning recipients of potential legal action if ignored.
When victims open the attachment, they're redirected to download a password-protected file that installs two dangerous programs: Amatera Stealer, which harvests passwords and cryptocurrency wallets from browsers and apps like Telegram, and PureMiner, which secretly mines cryptocurrency using the victim's computer.
Fortiguard Labs researchers discovered this "fileless" attack chain, which avoids detection by loading malware directly into memory rather than saving files to disk. The campaign represents another wave of cyberattacks targeting Ukraine since Russia's 2022 invasion.
Source: Dark Reading