Loading story…
A previously unreported cyber espionage campaign has been uncovered targeting Russian military personnel and defense industry organizations. The campaign, attributed to the group known as Goffee, utilized phishing lures such as fake New Year concert invitations and forged official letters to entice victims into opening malicious XLL files. Once executed, these files deployed a new backdoor named EchoGather, which enabled attackers to collect system information, execute commands, and exfiltrate files to a command-and-control server disguised as a food delivery website. The phishing documents showed signs of artificial generation, including linguistic errors and poorly imitated Russian emblems, suggesting the use of AI-generated decoys to enhance stealth and evade detection.
Researchers from Intezer first identified the malicious XLL file on VirusTotal, with uploads originating from both Ukraine and Russia. The campaign demonstrates the evolving tactics of the Goffee group, which has been active since at least 2022, as they experiment with new methods to bypass security controls. The use of AI-generated content and XLL-based payloads highlights a growing trend in cyber espionage operations, particularly those targeting sensitive sectors such as defense. The full extent of the campaign's success and the specific data sought by the attackers remain unclear, but the operation underscores the persistent threat posed by sophisticated, state-aligned cyber actors.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting described the EchoGather campaign as using AI-generated decoy documents and XLL-based stealth techniques to improve lure credibility and evade detection. This added technical detail expanded public understanding of the same espionage operation.
By late December 2025, researchers reported a new Goffee campaign aimed at Russian military personnel and defense-industry organizations. The operation used fake New Year concert invitations and forged letters from Russian officials to deliver a malicious XLL file that installs the EchoGather backdoor.
The cyberespionage group Goffee, also known as Paper Werewolf, has been active since at least 2022. Earlier activity included custom malware use and exploitation of WinRAR vulnerabilities against Russian targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed a new phishing campaign to **GOFFEE**, an APT group tracked since 2023, targeting mainly technology organizations in Russia and newly extending to Belarus. The attackers sent emails with intentionally corrupted-looking documents that pushed victims to enable content, triggering remote template injection, a staged payload chain, and final **in-memory .NET** execution. The operation relied on a mix of phishing and living-off-the-land techniques, with operators conducting manual post-exploitation and using legitimate tools to blend into victim environments. Post-compromise activity included reconnaissance and theft of credentials and configuration data from software such as **AnyDesk**, **OpenVPN**, **Kerio Control**, **Telegram**, and **pgAdmin**, along with data exfiltration hidden in HTTP `User-Agent` headers. Investigators also observed GOFFEE bringing its own `mshta.exe`, establishing persistence through **InstallUtil.exe** and a malicious service disguised as ASUS software, and modifying pgAdmin source code to redirect communications to attacker-controlled infrastructure. In a notable escalation, researchers identified a **Mythic** agent running inside a Linux container, likely launched through a tampered RabbitMQ service script and executed filelessly with `memfd_create`, marking the group’s apparent move into containerized environments.
Jul 30, 2026
WithSecure reported that a previously undocumented Russia-linked threat group, **GREYVIBE**, has conducted cyber espionage operations against Ukrainian military, government, civilian, and business organizations since at least August 2025. The actor reportedly used **ChatGPT**, **Google Gemini**, and **Ideogram AI** across multiple stages of its operations, including phishing-lure creation, malware and loader development, obfuscation, infrastructure setup, and post-compromise activity. Delivery methods included spear-phishing emails, fake CAPTCHA pages, fraudulent Ukrainian adult-club websites, and charity-themed lure sites. Researchers said GREYVIBE deployed malware families including **PhantomRelay**, **LegionRelay**, and **FallSpy**, and assessed the operators as Russian-speaking and aligned with Kremlin intelligence interests tied to the war in Ukraine. Despite broad AI adoption, the group was described as low-to-moderately sophisticated and prone to operational security failures, including public malware uploads, exposed development artifacts, and flaws in `LegionRelay` that revealed parts of its backend infrastructure. Investigators also noted signs of overlap with the Russian cybercrime ecosystem, including cybercrime-linked tooling and occasional **XMRig** deployment, underscoring a blurred line between state-aligned espionage and criminal tradecraft.
Aug 14, 2026
Russian authorities said foreign hackers acting as **cyber mercenaries** breached multiple federal executive bodies and stole confidential information in a targeted campaign uncovered in 2020. A joint report from Rostelecom-Solar and the National Coordination Center for Computer Incidents said the intruders used three primary access routes: tailored spear-phishing, exploitation of internet-facing web application flaws, and compromises of government contractors that enabled trusted-relationship access into agency networks. After gaining entry, the attackers conducted internal reconnaissance, targeted administrators’ workstations and infrastructure management systems, and collected data from mail servers, document management platforms, file servers, and employee endpoints. Investigators said the operation relied on previously unseen malware, including **`Mail-O`** and **`Webdav-O`**, to provide stealthy backdoor access, execute commands, and exfiltrate data through Russian cloud services while mimicking legitimate **Yandex Disk** and **Mail.ru Disk-O** traffic. The report also said the attackers tailored their activity to evade detection by deployed security tools, including abuse of legitimate components of a widely used Russian antivirus product to gather information about victim networks.
Aug 14, 2026