The group carries out cybercrime activities targeting individuals, SMEs, bank customers and cryptocurrency traders in various regions, including Europe. It also carries out espionage activities on government bodies in Europe and Central Asia: in 2022, it attacked government officials in countries bordering Ukraine
ESET, a global European leader in the cybersecurity market, has published its analysis on Asylum Ambuscade, a cybercriminal group that has been conducting sideline cyberespionage operations since at least 2020. ESET has detected previous breaches involving government officials and state-owned company employees in Central Asian countries and Armenia. In 2022 the group reportedly targeted government officials in several European countries bordering Ukraine. ESET Research believes the attackers' goal was to steal sensitive information and webmail credentials from official government portals. Asylum Ambuscade typically targets small and medium-sized businesses (SMEs) and individuals in North America and Europe.
"Asylum Ambuscade appears to be expanding, occasionally conducting some recent cyberespionage campaigns against governments in Central Asia and Europe. It is quite unusual to find a cybercrime group running dedicated cyberespionage operations, and for this reason we believe researchers should keep tabs on its activities," he explains Matthieu Faou, ESET researcher who investigated the group's activities.
In 2022, when the group attacked government officials in several European countries bordering Ukraine, the breach process began with a spearphishing email containing a malicious Excel spreadsheet or Word document sent as an attachment. If the victim was deemed to be of interest, the attackers distributed AHKBOT, a downloader that can be expanded with plugins to spy on compromised stations. These plugins provide various functionality, including capturing screen shots, logging keystrokes, stealing passwords from web browsers, downloading files, and running an infostealer.
Although the group has risen to prominence for its cyberespionage operations, since the beginning of 2020 it has primarily been running cybercrime campaigns. Since January 2022, ESET Research has counted more than 4,500 victims worldwide. While most of these are found in North America, it should be noted that victims have also been recorded in Asia, Africa, Europe and South America. The target is very broad and mainly includes individuals, cryptocurrency traders, bank customers and SMEs in various sectors.
"The Asylum Ambuscade crimeware breach process is, overall, very similar to that of cyberespionage campaigns. The main difference is the compromise vector, which could be a malicious Google ad that redirects to a website serving a malicious JavaScript file or multiple HTTP redirects," adds Faou.
For more technical information on Asylum Ambuscade, see the article “Asylum Ambuscade – A curious case of a threat actor on the border between crimeware and cyberespionage” su WeLiveSecurity.
