Skip to content
Threat Feed
Subscribe

Tag

Ukraine

5 briefs RSS
high threat

UAC-0145 Uses ClickFix CAPTCHAs to Distribute Data-Stealing Malware

Russian state-sponsored threat actor UAC-0145 (Sandworm sub-cluster) is actively targeting Ukrainian organizations by using fake ClickFix CAPTCHAs on compromised websites to trick users into executing malicious PowerShell commands, leading to the deployment of data-stealing malware on Windows and Android devices.

UAC-0145 malware state-sponsored data-theft social-engineering windows android ukraine backdoor
2r 9t
high threat

GreyVibe Targets Ukraine with AI-Generated Lures and Custom Malware

The likely Russian-aligned GreyVibe group is targeting Ukrainian organizations with AI-generated lures delivered via spear-phishing and malicious websites, deploying custom malware such as PhantomRelay, LegionRelay, and FallSpy to exfiltrate sensitive data.

google drive +8 GreyVibe ai-generated-lures cyberespionage ukraine malware phantomrelay legionrelay fallspy
2r 8t
high threat

FrostyNeighbor Targets Ukraine with Updated PicassoLoader Chain

The FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.

PoC Cobalt Strike +8 FrostyNeighbor cyberespionage cobaltstrike picassoloader ukraine
2r 3t 5c 16i updated
high threat

Operation GhostMail: Russian APT Exploiting Zimbra XSS to Target Ukraine Government

A Russian APT group is exploiting a Zimbra XSS vulnerability (details unspecified) to target the Ukrainian government in an operation dubbed 'GhostMail'.

Russian APT zimbra xss ukraine apt
2r 1t
high threat

APT28 Targeting Roundcube Webmail in Ukraine

APT28 (Fancy Bear) is actively targeting Roundcube webmail platforms to compromise government and defense email accounts, leveraging Roundcube's vulnerabilities and widespread use, primarily targeting Ukrainian entities in an activity tracked as Operation Roundish.

Roundcube Webmail APT28 +6 roundcube webmail ukraine exploitation
2r 3t