"mail.ru" emails target state institutions, seeking passwords and confidential information
Government institutions in the Republic of Moldova are being targeted by a campaign of email-based cyberattacks. Attackers send messages that appear to contain financial documents, such as payment orders or invoices, but the attachments are malicious. If opened, they can steal passwords and other confidential information.
The Information Technology and Cyber Security Service (STISC) issued the warning on Tuesday, October 13.
The suspicious messages are sent from various email addresses using the "mail.ru" domain.
To persuade recipients to open the files, the attackers present them as routine financial documents.
In reality, these files contain programs that can compromise computer and data security, STISC specialists explain.
"The attacks aim to steal sensitive information and authentication credentials by distributing malicious messages designed to trick recipients into downloading and accessing dangerous files," the agency warns.
Specifically, the files are sent in ZIP or 7z archives—formats commonly used to compress documents. However, inside are files with the ".bat" extension, which can execute commands on the computer.
These files use names such as "Payment Order" or "Paid Invoices" to make them appear legitimate.
This method is known as "spear phishing" and involves sending deceptive messages to specifically targeted recipients.
Unlike random fraudulent messages, these attacks target specific individuals or institutions; in this instance, government bodies in the Republic of Moldova are the primary targets. STISC advises employees of public institutions and companies, as well as ordinary users, not to open file attachments in suspicious messages and to carefully check the sender's address, even if the displayed name appears familiar.
