Loading story…
Google Threat Intelligence Group (GTIG) attributed a previously undocumented threat actor—assessed as possibly affiliated with Russian intelligence services—to phishing-led intrusions delivering CANFAIL, an obfuscated JavaScript malware used against Ukrainian organizations. Targeting has focused on defense, military, government, and energy entities, with reported expansion into aerospace, manufacturing tied to military/drone supply chains, nuclear/chemical research, and international organizations involved in conflict monitoring and humanitarian aid. GTIG reported the actor has begun using LLMs to compensate for limited sophistication, including generating reconnaissance outputs, crafting social-engineering lures, and seeking guidance for post-compromise actions and C2 setup.
The observed infection chain uses LLM-generated phishing lures and Google Drive links that deliver a RAR archive containing CANFAIL, often disguised with a double extension such as *.pdf.js to appear benign. CANFAIL is designed to execute a PowerShell script to continue execution and enable follow-on activity. GTIG also noted regional spillover and related targeting, including impersonation of Ukrainian energy organizations and a Romanian energy company serving customers in Ukraine, plus activity against a Romanian firm and reconnaissance on Moldovan organizations; the actor reportedly builds tailored email lists by region and industry to support these campaigns.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group publicly tied the CANFAIL malware attacks to a previously undocumented suspected Russian threat actor and described the group's expanding targeting priorities. GTIG also said the actor was using large language models to aid reconnaissance, lure creation, and basic post-compromise tasks.
A previously undocumented threat actor assessed as possibly affiliated with Russian intelligence services carried out phishing campaigns delivering CANFAIL malware against Ukrainian organizations. Primary targets included defense, military, government, and energy entities, with additional targeting or reconnaissance involving Romania and Moldova.
SentinelLABS and the Digital Security Lab of Ukraine documented the "PhantomCaptcha" campaign in October 2025. This activity was later linked to the same suspected Russia-aligned actor associated with CANFAIL malware operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
wiu.edu
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group reported that suspected Russian operation **UNC5812** used a hybrid espionage-and-influence campaign to target potential Ukrainian military recruits through a Telegram persona and a website branded **"Civil Defense."** Promoted posts in legitimate Ukrainian-language Telegram channels lured users to actor-controlled infrastructure that pushed anti-mobilization narratives, solicited videos alleging abuse by Ukrainian recruitment centers, and amplified messaging aligned with broader pro-Russian influence networks. The operation also delivered malware to both Windows and Android users. Windows victims were led through a multi-stage infection chain involving **Pronsis Loader**—a JPHP-based malware family also documented by Trustwave as distinct from D3F@ck Loader—before deployment of **PURESTEALER**, while Android users were tricked into disabling **Google Play Protect** and granting permissions needed for **CRAXSRAT**; researchers also identified a decoy mapping application tracked as **SUNSPINNER**. Google said it added related files and infrastructure to **Safe Browsing**, relied on Play Protect protections, and shared findings with Ukrainian authorities, who blocked national resolution of the Civil Defense site.
Aug 14, 2026
The Russia-linked **Gamaredon** threat group, also tracked as **ACTINIUM**, **Primitive Bear**, **Shuckworm**, and **Aqua Blizzard**, has been tied to sustained spearphishing operations against Ukrainian government and state institutions. Reporting describes lure documents delivered through spoofed or compromised email accounts, with infection chains using remote template injection, **VBA macros**, and malware components including **GammaDrop**, **GammaLoadIdentifier**, and the custom backdoor **Pteranodon**. Researchers said the activity remained ongoing across multiple waves and was aimed at gaining initial access and maintaining footholds inside targeted environments. Technical analysis linked the campaign to abuse of **`CVE-2025-8088`**, startup-folder **VBScript** persistence, changes to Microsoft Word macro security registry settings, host identifier collection, and HTTP-based command-and-control communications over dynamic DNS-hosted infrastructure. Separate infrastructure research expanded on previously reported Gamaredon/ACTINIUM network assets by using passive DNS pivots, identifying domain and subdomain patterns, shared IP reuse, and additional likely attacker-controlled **`.ru`** domains consistent with the group’s broader operational infrastructure.
Aug 15, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026