Two disinformation campaigns were discovered between November and December 2023 spread in Ukraine and other European countries to influence and demoralize citizens with misleading messages on topics related to the conflict.
There are many similarities with the activities of the APT Callisto group
ESET, a global European leader in the cybersecurity market, recently uncovered Operation Textonto, a disinformation/psychological operations (PSYOP) campaign that uses spam emails as its primary distribution method. Through messages sent in two waves, pro-Russian threat actors sought to influence and demoralize Ukrainian citizens with conflict-related disinformation messages. The first wave took place in November 2023 and the second at the end of December 2023. The contents of the emails concerned the interruption of heating, shortages of medicines and food, typical themes of Russian propaganda. Additionally, in October 2023, ESET detected a spearphishing campaign targeting a Ukrainian defense company and one targeting an EU agency in November 2023, using fake but realistic-looking Microsoft login pages. The objective of both was to steal the credentials of Microsoft Office 365 accounts. The similarities in the network infrastructure used in PSYOP and phishing operations lead researchers to believe that there is a link between the two.
"Since the beginning of the conflict, Russian-aligned groups such as Sandworm have been busy destroying Ukraine's IT infrastructure through the use of wipers. In recent months we have observed an increase in cyberespionage operations, especially by the infamous Gamaredon group. Operation Textonto shows yet another use of technologies to try to influence the course of the conflict," he says Matthieu Faou, ESET researcher who discovered the Textonto operation.
"The strange mix of espionage, information operations and false messages about drug shortages can only remind us of Callisto, a notorious Russia-aligned cyberespionage group, which saw some of its members subject to an indictment by the US Department of Justice in December 2023. Callisto tends to target government officials, think tank staff and military organizations through spearphishing websites designed to mimic common cloud providers. The group has also conducted disinformation operations, such as document leaks ahead of the 2019 UK general election. Finally, it created fake pharmaceutical domains by exploiting old network infrastructure,” continues Faou. However, he concludes: "Although there are several points of similarity between the Textonto operation and the Callisto operations, we did not find any technical overlap and at this time we cannot attribute the Textonto operation to a specific threat actor. In any case, given the TTPs, targets and message dissemination, we can confidently say that the operation was conducted by a pro-Russian group."
An email server operated by the attackers and used to send PSYOP emails was repurposed in January this year to send spam typical of Canadian pharmaceutical companies. This category of illegal activities has long been very popular in the Russian cybercrime community. Some other pivots also revealed domain names that are part of Operation Textonto and are related to internal Russian issues. This means that Operation Textonto probably also extends to domain names of other countries and that Operation Textonto probably includes spearphishing or information operations targeting Russian dissidents and supporters of the late opposition leader.
The goal of the first wave of disinformation emails was to sow doubt in the minds of Ukrainians; There are examples of emails warning that “There may be heating outages this winter.” Others apparently coming from the Ministry of Health, which speak of a shortage of medicines. It does not appear that this specific wave was accompanied by malicious links or malware, it seems that it was aimed solely at misinformation. A domain masquerading as the Ukrainian Ministry of Agrarian Policy and Food recommended replacing unavailable medicines with herbs. In another email from the 'Ministry', it was suggested to eat 'pigeon risotto' with disturbing images of a live pigeon and a cooked one. These documents were purposely created to upset and demoralize readers. Overall, these fake messages are in line with the typical themes of Russian propaganda. They try to make Ukrainians believe that they will not have medicines, food and heating due to the conflict.
About a month after the first wave, ESET detected a second PSYOPs email campaign that targeted not only Ukrainians, but also users from other European countries. The targets appear to be random and range from the Ukrainian government to an Italian shoe manufacturer. According to ESET telemetry, a few hundred people received emails during this wave that were darker in messaging, with the attackers advising recipients to amputate a leg or arm to avoid military deployment. Overall, this was an attack that bears the hallmarks of wartime PSYOP.
ESET products and research have been protecting Ukraine's IT infrastructure for many years. And since the Russian invasion began in February 2022, ESET Research has prevented and investigated a significant number of attacks launched by pro-Russian groups.
For more information on the techniques related to Operation Textonto, see the blog post “Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war” are WeLiveSecurity.com.
