Intrusions by UAC-0063 involved the initial compromise of an employee’s email account to facilitate the delivery of the malware strains, with Cherryspy enabling Python code execution and Hatvibe allowing further compromise, said CERT-UA, which also noted the group’s potential compromise of Armenia’s defense ministry. Such a development comes a month after CERT-UA’s discovery of widespread Hatvibe injections by exploiting an HTTP File Server vulnerability.

Source: SC Magazine