Russia-Linked Intrusions in Ukraine Using Living-Off-the-Land Tactics

Suspected Russian threat actors breached Ukrainian organizations by leveraging 'living-off-the-land' (LotL) techniques, primarily using legitimate administrative tools and minimal custom malware to evade detection and maintain persistence. The attacks, detailed by Symantec and Carbon Black, targeted a large business services company and a local government agency, with initial access achieved through webshells—most notably the Localolive webshell, previously associated with the Sandworm group. Attackers exploited unpatched vulnerabilities on public-facing servers to deploy these webshells, then used PowerShell backdoors and scheduled tasks to further their objectives, including data exfiltration and system reconnaissance.

The threat actors demonstrated advanced knowledge of Windows native tools, running commands to exclude certain directories from antivirus scans, dumping registry hives, and enumerating files and processes—potentially to target password managers like KeePass. The use of dual-use tools and LotL tactics allowed the attackers to remain undetected for extended periods, highlighting the sophistication and stealth of Russian-linked cyber operations against Ukrainian targets. While a direct attribution to Sandworm was not confirmed, the tactics and tools used align with previous campaigns attributed to Russian military intelligence.