Hackers Impersonating CERT-UA Use Security Audit Lures via AnyDesk

• Ukraine’s Computer Emergency Response Team (CERT-UA) notified users of fraudsters posing as its personnel to gain access to systems.
• Cybercriminals add legitimacy to their campaign using the CERT-UA logo and other items.
• Authorities confirmed it as a social engineering tactic to gain trust and the target’s information.

Hackers are using remote desktop application AnyDesk to gain access to targeted devices allegedly on behalf of CERT-UA. The scam came to light when the Computer Emergency Response Team of Ukraine (CERT-UA) posted about a similar incident. 

The presently unknown cybercriminals send AnyDesk requests on the pretext of conducting a security audit on behalf of the CERT-UA, the Ukraine agency report read. 

CERT-UA clarified that threat actors leveraged the name CERT.UA, the CERT-UA logo, and the AnyDesk identifier 1518341498 (which may vary).

The report further mentioned that the government body uses remote access when required but only after obtaining prior approvals and confirmation. 

Scammers are likely looking to gain personal information on the principles of trust and use of authority, the report warned further adding that it appears to be a social engineering tactic. It could also be used for spying or cyber espionage.

Users of the AnyDesk software are urged not to share any information with people contacting them on behalf of CERT-UA or AnyDesk without prior confirmation. They must keep the remote access app enabled only until a session lasts and not allow anyone to connect to it without prior agreement from the official website. 

For this scam to work, the attackers need to have the target’s AnyDesk ID and the software must be installed on their system. They might have obtained a user’s AnyDesk ID from a previous cybersecurity incident or from a vendor attack. 

This is not the first time for such attacks, as similar attempts using AnyDesk were reported in the past. In another incident, a ransomware group named Mad Liberator was found using AnyDesk to show a false Windows update message on the target’s device while stealing system data in the background.