Criminals began conducting cyberattacks on Russian industrial…
Criminals began conducting cyberattacks on Russian industrial enterprises, demanding disclosure of schemes for sheltering against drones and rocket threats in the name of a federal agency.
Consensus
- Cybercriminals are impersonating representatives of federal agencies to target Russian industrial enterprises.
- The attackers send emails with the subject line 'О мерах по обеспечению безопасных условия труда работников' (On measures to ensure safe working conditions).
- The emails are sent via public email services and use a fake email address mimicking official government domains.
- The emails request industrial enterprises to provide plans for protection against drones and missile threats, including shelter schemes, evacuation routes, and briefing materials.
- The emails claim that employees may refuse to work during air raid alerts without fear of dismissal if they notify management.
- The emails also claim that employers are required to prohibit work in hazardous areas, reduce night shifts, and approve shelter and evacuation plans in the near future.
- The F6 cybersecurity company detected and blocked a similar email campaign targeting 500 enterprises and organizations in July.
Points of divergence
- The phone number listed in the emails is linked to a domain registered in Ukraine. — vesti
- The email attachments did not contain malicious software but were styled in an official format to encourage disclosure of confidential information. — vesti
- Phone scammers are increasingly using specific terms like 'безопасный счет' (safe account) or 'ФСБ' (FSB) to intimidate and deceive individuals. — vesti
Coverage (2 sources)
- RBC: scammers are trying to get from enterprises schemes of shelters from drones — Вести
- Scammers are conducting cyberattacks on Russian industrial enterprises, demanding disclosure of shelter schemes from the face of a federal agency... — ТАСС (Telegram)