Loading story…
Suspected Russian threat actors breached Ukrainian organizations by leveraging 'living-off-the-land' (LotL) techniques, primarily using legitimate administrative tools and minimal custom malware to evade detection and maintain persistence. The attacks, detailed by Symantec and Carbon Black, targeted a large business services company and a local government agency, with initial access achieved through webshells—most notably the Localolive webshell, previously associated with the Sandworm group. Attackers exploited unpatched vulnerabilities on public-facing servers to deploy these webshells, then used PowerShell backdoors and scheduled tasks to further their objectives, including data exfiltration and system reconnaissance.
The threat actors demonstrated advanced knowledge of Windows native tools, running commands to exclude certain directories from antivirus scans, dumping registry hives, and enumerating files and processes—potentially to target password managers like KeePass. The use of dual-use tools and LotL tactics allowed the attackers to remain undetected for extended periods, highlighting the sophistication and stealth of Russian-linked cyber operations against Ukrainian targets. While a direct attribution to Sandworm was not confirmed, the tactics and tools used align with previous campaigns attributed to Russian military intelligence.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
On or before October 29, 2025, Symantec’s Threat Hunter Team and VMware Carbon Black publicly reported the intrusions against Ukrainian organizations. The researchers said the activity was likely Russian in origin, noted overlap with prior Sandworm reporting, but stopped short of confirming attribution.
In a separate summer 2025 intrusion, the same or related operators breached a Ukrainian local government entity for about a week. The activity involved reconnaissance, credential theft, persistence mechanisms, and use of dual-use tools with minimal malware.
During summer 2025, attackers assessed as likely Russian compromised a large Ukrainian business services company and maintained access for roughly two months. They exploited unpatched vulnerabilities, deployed web shells including Localolive, and relied heavily on living-off-the-land techniques and legitimate tools to evade detection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Cyber operations tied to Russia’s invasion of Ukraine ranged from destructive malware and espionage to broader disruption against Ukrainian and allied targets. Researchers and government agencies documented **WhisperGate**, **HermeticWiper**, **CaddyWiper**, **DoubleZero**, and **FoxBlade** activity against Ukrainian networks, while Microsoft said it seized seven **Strontium** domains used to target Ukrainian institutions, media, and foreign-policy organizations in the U.S. and EU. Talos also reported a campaign against a Ukrainian software developer using a modified **GoMet** backdoor, raising supply-chain concerns, and Symantec described sustained **Shuckworm/Gamaredon** espionage using multiple **Pterodo** variants for persistence. Later reporting warned that Russian operations were expanding beyond Ukraine to logistics, transportation, defense, and energy organizations supporting Kyiv, including activity in Poland and across Europe’s defense supply chain.
Aug 15, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026