Cybersecurity incident — 2022-02-01 00:00:00
Affected organization: Undetermined
Affected country: Ukraine
Industry: Finance and Insurance
Event type: Exploitive
Event subtype: Exploitation of End Host
Motive: Political-Espionage
Actor: UAC-0056
Actor type: Nation-State
Actor country: Russian Federation

Spear phishing email was sent to an employee of a Ukrainian energy organization containing malicious files that would download and install a payload known as SaintBot (a downloader) and OutSteel (a document stealer). The same threat actor group targeted a Western government entity in Ukraine, as well as several Ukrainian government organizations back in March 2021.