Pro-Ukrainian Hacktivists Expand Exchange Intrusions Into CIS and Middle East

Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including 4BID, Hacker kiт, C.A.S, and Goffee, expanded attacks beyond Russia and Belarus to targets in Kazakhstan, the UAE, Syria, and Egypt. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange ProxyShell vulnerabilities, followed by deployment of the fd.aspx ASP.NET web shell, execution of PowerShell or cmd.exe, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring.

The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including Sliver, Havoc, Mythic Apollo, AdaptixC2, BlackSalt backdoor, Warp RAT, BlackReaperRAT, ClearWater ransomware, and an updated Blackout Locker. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with ChaCha20 and RSA-2048, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.