{"id":19048,"date":"2022-02-10T06:37:16","date_gmt":"2022-02-10T06:37:16","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=19048"},"modified":"2026-04-17T18:07:45","modified_gmt":"2026-04-17T18:07:45","slug":"russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/","title":{"rendered":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs"},"content":{"rendered":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<html><body><p>Recently, NSFOCUS Security Labs captured a fishing document with the theme &#8220;&ETH;&Yuml;&ETH;&ETH;&nbsp;&ETH;&cent;&ETH;&ETH;&bull;&ETH;&nbsp;&ETH;&tilde; &ETH;&scaron;&ETH;&pound;&ETH;&rsaquo;&ETH;&not;&ETH;&cent;&ETH;&pound;&ETH;&nbsp;&ETH;&ETH;&#382;&ETH;&Dagger; &ETH;&rdquo;&ETH;&tilde;&ETH;&Yuml;&ETH;&rsaquo;&ETH;&#382;&ETH;&oelig;&ETH;&ETH;&cent;&ETH;&dagger;&ETH;&Dagger; &ETH;&oelig;&ETH;&mdash;&ETH;&iexcl; &ETH;&pound;&ETH;&scaron;&ETH;&nbsp;&ETH;&ETH;&Dagger;&ETH;&ETH;&tilde;&#8221; (Cultural Diplomatic Partner of the Ukrainian Ministry of Foreign Affairs), and confirmed that the producer of the document was Gamaredon, a Russia-based&nbsp;advanced persistent threat group.<\/p>\n\n\n\n<p>The phishing document contains highly credible bait content, and uses a payload protection method with user information as the private key, which is in line with the behavioral characteristics of this threat actor.<\/p>\n\n\n\n<p>Since 2021, relations between Russia and Ukraine have increasingly deteriorated. Both sides have deployed large numbers of military personnel and equipment in the border areas of the two countries. In late January, the US Secretary of State stated in talks with many European countries that once Russia carried out its military aggression against Ukraine, it would have serious consequences.<\/p>\n\n\n\n<p>In order to prepare for a possible Russian-Ukrainian war, Russian intelligence services have carried out long-term intelligence-gathering work. The Russian cyber groups, represented by Gamaredon, completely abandoned the principle of concealment of intelligence work, and launched persistent spear phishing attacks on Ukrainian governmental and military organizations. The purpose of these attacks was to collect information from the targets&acirc;&euro;&trade; staff and documents.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Process Analysis<\/h2>\n\n\n\n<p>This phishing document NSFOCUS Security Labs captured is disguised as a reference material of a government organization, with an address list of cultural diplomatic partners of the Ministry of Foreign Affairs of Ukraine in fields of Information and Politics, Art, Music, Film, Theatre and so on.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1.jpg\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"685\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1-1024x685.jpg\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-19036\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1-1024x685.jpg 1024w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1-300x201.jpg 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1-768x513.jpg 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1-200x134.jpg 200w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon1.jpg 1442w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>Based on the content of this document, which is likely a part of information collected by Gamaredon in their operations, it is inferred that the target is the staff of the Ukrainian Ministry of Foreign Affairs. The document implements the attack through an embedded malicious macro. The macro releases two VBS files to the startup and theme directories of the system respectively to realize automatic startup and execute the subsequent attack process.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2.jpg\"><img decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2-1024x679.jpg\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-19034\" width=\"768\" height=\"509\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2-1024x679.jpg 1024w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2-300x199.jpg 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2-768x509.jpg 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2-200x133.jpg 200w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/gamaredon2.jpg 1057w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/a><\/figure>\n\n\n\n<p>The script named Themes.vbs sends the computer name and system disk serial number to a fixed URL, and then obtains the subsequent Trojan payload from the response of the URL. It is worth noting that the subsequent Trojan payload uses XOR encryption, and the XOR key is the disk serial number sent by Themes.vbs. This payload protection technology using host information is commonly seen in APT activities launched by threat groups such as Gamaredon and OceanLotus.<\/p>\n\n\n\n<p>The communication domain name of the VBA files was flagged by ESET as a web property of Gamaredon in 2020. Whois information shows that the domain name is mainly used from 2020 to 2021. The phishing document came from Gamaredon&#8217;s early cyber attack activities shows that Gamaredon had already mastered a large number of Ukrainian government documents at that time.<\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"<p>Recently, NSFOCUS Security Labs captured a fishing document with the theme &#8220;&ETH;&Yuml;&ETH;&ETH;&nbsp;&ETH;&cent;&ETH;&ETH;&bull;&ETH;&nbsp;&ETH;&tilde; &ETH;&scaron;&ETH;&pound;&ETH;&rsaquo;&ETH;&not;&ETH;&cent;&ETH;&pound;&ETH;&nbsp;&ETH;&ETH;&#382;&ETH;&Dagger; &ETH;&rdquo;&ETH;&tilde;&ETH;&Yuml;&ETH;&rsaquo;&ETH;&#382;&ETH;&oelig;&ETH;&ETH;&cent;&ETH;&dagger;&ETH;&Dagger; &ETH;&oelig;&ETH;&mdash;&ETH;&iexcl; &ETH;&pound;&ETH;&scaron;&ETH;&nbsp;&ETH;&ETH;&Dagger;&ETH;&ETH;&tilde;&#8221; (Cultural Diplomatic Partner of the Ukrainian Ministry of Foreign Affairs), and confirmed that the producer of the document was Gamaredon, a Russia-based&nbsp;advanced persistent threat group. The phishing document contains highly credible bait content, and uses a payload protection method [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":19042,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3,15],"tags":[93,421,582],"class_list":["post-19048","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-research-reports","tag-apt","tag-gamaredon","tag-phishing"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Recently, NSFOCUS Security Labs captured a fishing document with the theme\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2022-02-10T06:37:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg\" \/>\n<meta name=\"author\" content=\"Jie Ji\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Recently, NSFOCUS Security Labs captured a fishing document with the theme\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jie Ji\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/\"},\"author\":{\"name\":\"Jie Ji\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\"},\"headline\":\"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs\",\"datePublished\":\"2022-02-10T06:37:16+00:00\",\"dateModified\":\"2026-04-17T18:07:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/\"},\"wordCount\":530,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/3918-scaled-e1644465987125.jpg\",\"keywords\":[\"APT\",\"Gamaredon\",\"Phishing\"],\"articleSection\":[\"Blog\",\"Research &amp; Reports\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/\",\"name\":\"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/3918-scaled-e1644465987125.jpg\",\"datePublished\":\"2022-02-10T06:37:16+00:00\",\"dateModified\":\"2026-04-17T18:07:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#primaryimage\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/3918-scaled-e1644465987125.jpg\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2022\\\/02\\\/3918-scaled-e1644465987125.jpg\",\"width\":250,\"height\":143,\"caption\":\"Dotted map of Ukraine with flag.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/#\\\/schema\\\/person\\\/1077d8fcd7e52c96f17a33b63a0d157b\",\"name\":\"Jie Ji\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g\",\"caption\":\"Jie Ji\"},\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/jji\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"pt_BR","og_type":"article","og_title":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS","og_description":"Recently, NSFOCUS Security Labs captured a fishing document with the theme","og_url":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/","og_site_name":"NSFOCUS","article_published_time":"2022-02-10T06:37:16+00:00","article_modified_time":"2026-04-17T18:07:45+00:00","og_image":[{"url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","type":"","width":"","height":""}],"author":"Jie Ji","twitter_card":"summary_large_image","twitter_title":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS","twitter_description":"Recently, NSFOCUS Security Labs captured a fishing document with the theme","twitter_image":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","twitter_misc":{"Escrito por":"Jie Ji","Est. tempo de leitura":"3 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/"},"author":{"name":"Jie Ji","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b"},"headline":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs","datePublished":"2022-02-10T06:37:16+00:00","dateModified":"2026-04-17T18:07:45+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/"},"wordCount":530,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","keywords":["APT","Gamaredon","Phishing"],"articleSection":["Blog","Research &amp; Reports"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/","url":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/","name":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#primaryimage"},"thumbnailUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","datePublished":"2022-02-10T06:37:16+00:00","dateModified":"2026-04-17T18:07:45+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#primaryimage","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2022\/02\/3918-scaled-e1644465987125.jpg","width":250,"height":143,"caption":"Dotted map of Ukraine with flag."},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/russian-apt-group-gamaredon-launches-phishing-campaign-against-ukrainian-ministry-of-foreign-affairs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"Russian APT Group Gamaredon Launches Phishing Campaign against Ukrainian Ministry of Foreign Affairs"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#website","url":"https:\/\/nsfocusglobal.com\/pt-br\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/pt-br\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/pt-br\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/pt-br\/#\/schema\/person\/1077d8fcd7e52c96f17a33b63a0d157b","name":"Jie Ji","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/61cb438513c138ce3f1f49e3485f113a0215220de5e284a2bd4e85358f6c8d02?s=96&d=mm&r=g","caption":"Jie Ji"},"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/jji\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/19048","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=19048"}],"version-history":[{"count":0,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/19048\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media\/19042"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=19048"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=19048"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=19048"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}