{"id":24419,"date":"2022-12-19T14:29:53","date_gmt":"2022-12-19T14:29:53","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/19\/hackers-distributed-a-trojanized-build-of-windows-10-to-infiltrate-ukrainian-targets\/"},"modified":"2022-12-19T14:29:53","modified_gmt":"2022-12-19T14:29:53","slug":"hackers-distributed-a-trojanized-build-of-windows-10-to-infiltrate-ukrainian-targets","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/12\/19\/hackers-distributed-a-trojanized-build-of-windows-10-to-infiltrate-ukrainian-targets\/","title":{"rendered":"Hackers Distributed a Trojanized Build of Windows 10 to Infiltrate Ukrainian Targets"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n
This site may earn affiliate commissions from the links on this page. Terms of use<\/a>.<\/div>\n

<\/p>\n

\n
\n\"Windows-10\" <\/div>\n<\/div>\n

Downloading a copy of Windows from shady online sources is never a good idea, but it was even more dangerous in Ukraine recently. Cybersecurity firm Mandiant identified a trojanized version of Windows 10 being distributed online, and it was modified specifically to gain access to Ukrainian computer systems. While there are no clear fingerprints on the malicious ISO, Mandiant notes the targets overlap with previous operations from Russia\u2019s security services.<\/p>\n

The Windows installer purports to be a 64-bit build of Windows 10, labeled \u201cWin10_21H2_Ukrainian_x64.iso.\u201d It uses the Ukrainian language pack and was distributed primarily on toloka.to, a torrent tracker that focuses on Ukrainian users. It also appeared on a Russian torrent tracker. It seems likely this malware campaign is connected to the ongoing war in Ukraine.<\/p>\n

According to Mandiant<\/a>, the campaign doesn\u2019t appear to have any financial motive \u2014 there are no ransomware<\/a> installers or crypto miners to be seen. Although, distributing a Windows ISO isn\u2019t the most efficient way to get these malicious packages onto machines. It is, however, useful if you want complete access to a system with the ability to install additional malware packages when you find a juicy target. The way these additional tools were deployed led Mandiant to suspect Russia\u2019s GRU spy agency and government-backed hacking groups like APT28.<\/p>\n

\"\"<\/p>\n

Installing the malicious ISO will get you what appears to be a fully functional version of Windows 10, but the underlying code has been modified in several vital ways. For one, it doesn\u2019t send security telemetry back to Microsoft as a regular build of Windows does. After installation, embedded tools scan the system for useful information via scheduled and modified system tasks. That data is then sent to a remote server. Some installations were also loaded with additional malware tools after installation, suggesting these targets were of particular interest to the hackers.<\/p>\n

Mandiant identified several machines running the infected Windows version inside Ukrainian government networks. The machines began communicating with operators via an encrypted TOR tunnel in July 2022. This is a new kind of attack and one that we may see more often as the conflict in Ukraine drags on. Unlike many malware campaigns, this one is easy to avoid. Just don\u2019t download sketchy versions of Windows from torrent sites. Microsoft will actually let you download Windows ISOs<\/a> directly from the source these days.<\/p>\n

Now read: <\/strong><\/p>\n

<\/span>\n<\/div>\n