Pierluigi Paganini
January 09, 2023
The government institutions of Moldova have been hit by a wave of phishing attacks, threat actors sent more than 1,330 emails to accounts belonging to the country’s state services.
“The Information Technology and Cyber Security Service (STISC) warns of scam and phishing cyber attack campaigns targeting government institutions. To date, more than 1330 messages have been sent to the e-mail addresses of public institutions.” reads an alert published by Moldova’s cybersecurity regulator. “Owners of .md domains are informed by e-mail about the expiration of the domain name’s validity period and are asked to initiate the procedure for extending it, requesting access to a link to make the payment.”
The phishing messages attempt to trick recipients into clicking on an embedded link claiming that their domain is expiring. The link points to a fake payment page that recipients have to visit to renew their domains.
The messages pretend to be sent by the local hosting provider Alexhost, which also published an advisory to warn its customers of the ongoing campaign.
“Alexhost is warning you that someone is doing Phishing in our name. Alexhost asks all customers that is not alexhost doing that. Someone is using our name of our company without any consent. If you receive a email that redirects to any link that is not alexhost.com domain, that might be phishing and fake.” reads the advisory published by the provider. “Please don’t pay with your credit card! The email comes with a fake payment page.”
Since the beginning of the Russian invasion of Ukraine, pro-Russia threat actors hit Moldava due to its support to Kiev.
The Killnet group launched multiple DDoS attacks against governments that expressed support for Ukraine, including Moldova, Italy, Romania, the Czech Republic, Lithuania, Norway, and Latvia.
In October, another wave of attacks targeted tens of Moldovan institutions with distributed denial-of-service (DDoS) attacks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Moldova)
[adrotate banner=”5″]
[adrotate banner=”13″]
