SVG Phishing hits Ukraine with Amatera Stealer, PureMiner

Impact

For European organizations, especially those with diplomatic, governmental, or strategic ties to Ukraine, this threat poses a significant risk. The credential theft capabilities of Amatera Stealer could lead to unauthorized access to sensitive systems, data breaches, and espionage activities. This is particularly concerning for entities involved in political, defense, or critical infrastructure sectors. The cryptomining activity from PureMiner can degrade system performance, increase energy consumption, and potentially cause hardware damage, impacting operational continuity.

Even organizations not directly targeted may be at risk if the phishing campaign expands or if the malware spreads laterally. The use of fileless techniques complicates detection and remediation, increasing the likelihood of prolonged undetected presence within networks. Additionally, the campaign’s focus on government entities suggests a potential for geopolitical motivations, which could lead to targeted attacks on European institutions supporting Ukraine or involved in related geopolitical matters.

Defensive guidance

1. Enhance email security by configuring advanced filtering to detect and block SVG attachments and suspicious CHM or HTA files. Implement sandboxing to analyze attachments before delivery. 2. Educate users on the risks of opening unexpected or suspicious SVG files and attachments, emphasizing verification of sender authenticity. 3. Deploy endpoint detection and response (EDR) solutions capable of identifying fileless malware behaviors and multi-stage infection chains. 4. Monitor network traffic for connections to known malicious domains listed in the indicators and block them at the firewall or proxy level. 5. Implement strict application whitelisting to prevent execution of unauthorized CHM and HTA files. 6. Regularly audit and secure credential storage and access controls to limit the impact of stolen credentials. 7. Use multi-factor authentication (MFA) extensively to reduce the risk of compromised credentials leading to unauthorized access. 8. Continuously update and patch systems to minimize exploitation opportunities, even though this campaign does not exploit a specific CVE. 9. Conduct threat hunting exercises focusing on signs of cryptomining activity and unusual system resource usage. 10. Establish incident response plans specifically addressing multi-stage phishing and fileless malware attacks.