Loading story…
Researchers have identified a new intrusion cluster, GhostShell (MB-0009), targeting Ukraine’s drone operations, military units, suppliers, and volunteer organizations with lures themed around the legitimate drone company Besomar. The campaign has reportedly been active since at least February 2026 and relies on a malicious archive, Besomar_documentation.rar, containing Ukrainian-language decoy PDFs tailored to procurement, technical, military, and volunteer audiences. Reports say the archive exploits CVE-2025-8088 and CVE-2025-6218, installs a hidden script in the Windows Startup folder for persistence, and retrieves additional payloads from cloudaxis[.]cc.
The operation uses multiple malware components and layered command-and-control methods to hinder detection. Files including 122.exe, 22.exe, and update.exe were linked to the activity: 122.exe performs espionage tasks such as host identification and screenshot capture before sending data to cdnexpress[.]cc; 22.exe deploys Vidar v2 to steal browser credentials, browsing history, and cryptocurrency wallet data; and update.exe masquerades as a Windows security service while using the Telegram dead-drop t[.]me/flufff6262 to resolve live infrastructure. Researchers also reported an in-memory implant secured with mutual TLS and certificates issued by "GhostShell Implant CA", and said the group appears highly organized, though attribution to a specific nation-state remains unconfirmed.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Synaptic Systems/Synaptic Security reported that the newly tracked GhostShell (MB-0009) campaign has been active since at least February 2026, targeting Ukraine's drone operations, defense supply chain, military units, and volunteer groups. The activity used Besomar-themed lures and malware delivery infrastructure against organizations in Ukraine's UAV ecosystem.
On June 24, 2026, Synaptic Systems/Synaptic Security publicly identified the GhostShell (MB-0009) cluster and disclosed technical details of its tooling, including Besomar_documentation.rar, startup-folder persistence, an mTLS implant, a Telegram dead-drop resolver, and Vidar v2 deployment. The researchers said attribution to a specific nation-state would be premature and currently track GhostShell as an independent, highly organized cybercriminal group.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcecybersecuritynews.com
Open sourceblog.synapticsystems.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Russia-linked **Gamaredon** espionage group—also tracked as **ACTINIUM**, **Shuckworm**, and **Primitive Bear**—has continued targeting Ukrainian government, military, security, and research organizations with large-scale intrusion activity, including thousands of attacks attributed by Ukraine’s SSU to FSB-linked operators. Microsoft and Symantec documented sustained campaigns using spear-phishing, malicious attachments, **PowerShell**, and **VBScript** malware to gain access, maintain persistence, and steal sensitive information such as military reports, arsenal inventories, and personnel data. Check Point said the group added a newly identified **VBS-based USB worm** called **LitterDrifter**, which spreads through removable drives by planting hidden copies and malicious `.lnk` shortcuts while maintaining command-and-control through rapidly changing infrastructure. Researchers said the malware uses randomized subdomains of hardcoded `.ru` domains and can fall back to **Telegram** channels for C2 resolution, matching Gamaredon’s pattern of volatile infrastructure and frequent tool updates. Although the campaign remains focused on Ukraine, infections were also observed in countries including the United States, Vietnam, Chile, Poland, Germany, and Hong Kong, likely caused by uncontrolled USB propagation rather than deliberate targeting.
Aug 14, 2026
Russia-aligned **Gamaredon** significantly upgraded its cyberespionage operations against Ukrainian government and military organizations during 2025, according to ESET. The group ran **35 spear-phishing campaigns**, introduced **six new PowerShell-based tools**, revived the VBScript weaponizer **PteroSetup**, and exploited **`CVE-2025-8088`** in WinRAR to establish persistence through malicious HTA downloaders placed in Startup folders. ESET said Gamaredon also expanded lateral movement and USB-based propagation, with the newly documented **PteroPaste** able to copy a malicious downloader to connected USB drives while disguising it as a Word document shortcut. The group increasingly concealed command-and-control and data theft behind legitimate services, using **Cloudflare Workers**, **Microsoft dev tunnels**, **Loophole**, DDNS providers, messaging and blogging platforms, paste sites, and cloud storage to mask malicious traffic and stage payloads. Newer malware variants retrieved encrypted C2 data from dead-drop locations such as **Telegram**, **Dropbox**, **GoFile**, and **Mastodon**, while upgraded stealers including **PteroPSDoor** and **PteroVDoor** exfiltrated stolen files to S3-compatible storage such as **Wasabi**, **Tebi**, and **Intercolo**. ESET also observed Gamaredon collaborating with **Turla** in early 2025, providing initial access that supported deployment of the **Kazuar** framework.
Jun 30, 2026
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026