Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On February 24, 2022, a phishing email sent to a European government entity used an address that appeared to belong to a Ukrainian armed service member. Its macro-enabled spreadsheet attempted to download SunSeed, a Lua-based downloader. Proofpoint reported the incident on March 1, 2022, but did not definitively identify the operators or confirm that the attack collected information.
What happened in the February 2022 email attack?
Proofpoint detected the email on February 24, 2022. It was sent from a ukr.net address that appeared to belong to a Ukrainian armed service member and was directed to a European government entity. Proofpoint’s open-source research found the address listed as a contact on a 2016 Ukrainian public procurement document associated with a military unit. That supports the apparent military connection, but does not establish who controlled the account when the email was sent or prove that it had been compromised.
The subject referred to a decision of Ukraine’s Security Council dated February 24, 2022. The message included a macro-enabled spreadsheet titled “list of persons.xlsx.” Proofpoint said the file attempted to download SunSeed, a Lua-based downloader.
According to Proofpoint, SunSeed issued HTTP GET requests over port 80 to a command-and-control server and polled for a response. The report describes this network behavior; it does not establish what a later server response might have delivered or confirm that additional payloads were installed. Proofpoint’s incident report provides its technical account.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why were refugee logistics personnel targeted?
Proofpoint’s observed recipients were European government personnel whose responsibilities related to refugee logistics. The researchers noted roles involving transportation, financial and budget allocation, administration, and population movement. They cautioned that the dataset was limited, so these observations should not be treated as a complete picture of the campaign’s targets.
Proofpoint assessed that the operation may have sought intelligence about people leaving Ukraine and the funds, supplies, and logistics NATO member countries were using to manage the crisis. That is a hypothesis about the campaign’s possible purpose—not proof that information was successfully collected or a confirmed statement of operator intent.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What is confirmed, and what remains uncertain?
| Question | What the reporting establishes |
|---|---|
| What was observed? | Proofpoint reported an email to a European government entity, a spreadsheet attachment, and file behavior attempting to download SunSeed. |
| Was the sender definitely a Ukrainian service member? | No. The address appeared to belong to a service member, and a 2016 procurement document associated it with a military unit. This does not prove who controlled the account in February 2022. |
| Was the operation successful? | The report describes the attempted download and SunSeed’s polling behavior. It does not confirm successful collection of intelligence or establish the full outcome on a recipient’s system. |
| Who carried it out? | Proofpoint discussed possible links to TA445, also called UNC1151 or Ghostwriter in its account, but said it had not seen concrete technical overlaps sufficient for definitive attribution. |
| Was it part of phishing reported by Ukrainian government agencies? | Proofpoint said it had not definitively established that connection. |
Proofpoint considered timing, similarities to earlier activity, and victimology when discussing a possible relationship to TA445. Those are grounds for assessment, not conclusive technical attribution. Likewise, the observed email should not be presented as definitively connected to other phishing or influence activity. ENISA’s November 2022 threat-landscape report later summarized the activity as a likely nation-state-sponsored campaign, but did not resolve the specific actor attribution. ENISA Threat Landscape 2022
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What this incident shows about trusted-sender phishing
A message from an address that appears connected to a trusted person or institution can make a timely lure more convincing. In this case, the email invoked a Ukraine Security Council decision dated the same day it was detected, then attached a macro-enabled spreadsheet that attempted to retrieve malware. The apparent identity of the sender is not proof that the account holder composed or authorized the message.
For organizations, the incident is a reminder to assess unexpected attachments and verify unusual requests through a separate, trusted channel—even when the sender address looks familiar. The reporting does not identify a particular defensive product or establish that any single control would have prevented this attack.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Timeline and scope of the public reporting
- February 24, 2022: Proofpoint detected the email.
- March 1, 2022: Proofpoint published its incident report.
- November 2022: ENISA included the activity in its Threat Landscape 2022.
Proofpoint’s incident report does not provide a campaign-wide victim count, infection rate, or comparable statistic. The documented recipients and technical observations therefore describe the reported activity, not a quantified estimate of its overall reach.
Quick Recap
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →
