Cybersecurity incident — 2022-02-25 00:00:00
Affected organization: Undetermined
Affected country: Kazakhstan
Industry: Finance and Insurance
Event type: Exploitive
Event subtype: Exploitation of End Host
Motive: Undetermined
Actor: Ghostwriter
Actor type: Nation-State
Actor country: Belarus

UNC1151 has targeted Employees of a Kazakhstani education institution. Mass phishing emails have recently been observed; after the account is compromised, the threat actiors, by the IMAP protocol, get access to all the messages. Subsequently, the attacks leverage the contact information stored in the victim's address book to propagate the phishing messages to other targets.