Spearphishing

2026-07-0112 minESEThigh

Gamaredon, a Russia-aligned APT group attributed to the FSB, maintained high operational tempo throughout 2025 with 35 spearphishing campaigns exclusively targeting Ukrainian government and military institutions. The group introduced six new PowerShell tools, resurrected the PteroSetup VBScript weaponizer for lateral movement, and began abusing CVE-2025-8088 (WinRAR) for persistence via the Startup folder. A significant infrastructure evolution occurred: C&C servers are now hidden behind tunnel services (Cloudflare tunnels, Cloudflare workers, Microsoft devtunnels, Loophole) and dead-drop resolutions on legitimate platforms (Telegram, Telegra.ph, Rentry, GoFile, Dropbox, and others), while stolen data is exfiltrated to S3-compatible cloud storage (Wasabi, Tebi, Intercolo) rather than attacker-owned servers.

2026-06-024 minSentinelOnehigh

ESET researchers presented evidence of a 2025 espionage alliance between Russian state-aligned actors Gamaredon and Turla targeting Ukraine. Gamaredon utilized its lightweight custom tooling, including PteroGraphin and PteroOdd, to deploy Turla's Kazuar backdoor and maintain persistence for Turla's advanced espionage operations.

2026-05-148 minESEThigh

FrostyNeighbor, a Belarus-aligned threat actor, has updated its toolset to target Ukrainian governmental organizations with a multi-stage compromise chain. The attack utilizes spearphishing with malicious PDFs that redirect to a RAR archive containing a JavaScript dropper, which ultimately deploys a Cobalt Strike beacon via the PicassoLoader malware following strict server-side and manual victim validation.

2026-05-136 minTrend Microcritical

The Russia-aligned APT group Pawn Storm has launched a sophisticated campaign deploying the PRISMEX malware suite against Ukrainian and NATO defense supply chains. The attack chain leverages two critical vulnerabilities, CVE-2026-21509 and CVE-2026-21513, to achieve zero-click execution, utilizing advanced steganography and COM hijacking to evade detection while communicating via legitimate cloud services.

2026-05-135 minESETcritical

The Sednit threat group (APT28) has deployed a modernized espionage toolkit targeting Ukrainian military personnel. The toolkit consists of custom implants SlimAgent and BeardShell, alongside a heavily modified version of the Covenant framework, utilizing legitimate cloud storage providers for resilient Command and Control (C&C).

2026-05-137 minArctic Wolfcritical

Arctic Wolf Labs has identified a cyber espionage campaign by the Chinese-affiliated threat actor UNC6384 targeting European diplomatic entities. The campaign exploits the ZDI-CAN-25373 Windows shortcut vulnerability to deliver malicious LNK files, ultimately deploying the PlugX RAT via DLL side-loading of legitimate Canon printer utilities.