Loading story…
ESET detailed Operation Groundbait—also known as Prikormka—as a long-running cyber-espionage campaign that had been active since at least 2008 and focused primarily on individuals in Ukraine. The operation mainly targeted anti-government separatists in the self-proclaimed Donetsk and Luhansk People’s Republics, while also hitting Ukrainian government officials, politicians, journalists, and members of the nationalist Right Sector. The malware was delivered largely through spearphishing emails carrying malicious executables disguised as documents, with decoy files crafted to match victims’ political or professional interests.
The report described Prikormka as a modular surveillance toolkit built for persistence and intelligence collection. Its capabilities included downloading additional components, command-and-control communications, document theft, keylogging, screenshots, microphone and Skype recording, geolocation, password theft, and file inventory collection. ESET said the operators likely worked from within Ukraine, citing targeting patterns, language use, infrastructure, timestamps, and command-and-control access logs, and assessed that conclusion with moderate confidence.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a more sophisticated malicious activity cluster using the CloudWizard framework and assessed with medium to high confidence that the same threat actor behind Operation Groundbait/Prikormka was responsible. The campaign targeted individuals as well as diplomatic and research organizations across multiple regions of Ukraine and used cloud services such as OneDrive for command and control.
ESET identified the previously unknown modular malware family Prikormka in the third quarter of 2015 during its investigation of Operation Groundbait.
After relatively low infection ratios in earlier years, the number of Prikormka infections increased significantly in 2015, with Ukraine accounting for the vast majority of detections in ESET telemetry.
Around mid-2015, the operators changed from embedding Campaign IDs in binaries to storing Campaign IDs, and later Operator IDs, in rbcon.ini files.
ESET's research concluded that Operation Groundbait, also known as Prikormka, had been active since at least 2008 as a cyber-surveillance operation primarily targeting individuals in Ukraine.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET detailed **Operation Potao Express**, a long-running cyber-espionage campaign built around the `Win32/Potao` malware family and, in some cases, a trojanized TrueCrypt variant tracked as `Win32/FakeTC`. The activity was first observed in 2011 and targeted victims primarily in **Ukraine, Russia, and Georgia**, including Ukrainian government, military, and media organizations as well as members of the MMM Ponzi scheme. Researchers said the operation relied heavily on **social engineering** rather than software exploits, using phishing emails, spear-phishing SMS messages, fake postal-service websites, malicious executables disguised as documents, and USB-based propagation. The malware functioned as a modular espionage toolkit with plugins for **system profiling, file theft, password theft, screenshots, and keylogging**, while command-and-control traffic was protected with `RSA-2048` and `AES-256`. ESET also found that `truecryptrussia.ru` selectively served backdoored TrueCrypt downloads to chosen victims and simultaneously acted as command-and-control infrastructure, reinforcing the view that the campaign was professionally run and highly selective. The report did not make a definitive attribution, but said the malware was probably of **Russian origin** and highlighted several high-value Ukrainian targets among the victims.
Aug 14, 2026
Russia-aligned threat actor InedibleOchotense conducted a spear-phishing campaign targeting Ukrainian entities by impersonating the Slovak cybersecurity company ESET. Attackers distributed trojanized ESET installers via phishing emails and Signal messages, directing victims to fake ESET-branded domains such as `esetsmart[.]com`, `esetscanner[.]com`, and `esetremover[.]com`. The malicious installers delivered both a legitimate ESET AV Remover and the Kalambur backdoor, exploiting ESET’s strong reputation in Ukraine to increase the likelihood of successful compromise. The phishing messages contained minor language errors, likely due to poor translation from Russian to Ukrainian, and warned recipients of suspicious activity to prompt urgent action. The Kalambur backdoor, also known as SUMBUR, is a C# malware that leverages the Tor network for command-and-control communications and can deploy additional tools such as OpenSSH and enable RDP access on port 3389. Security researchers noted tactical overlaps between this campaign and previous activity attributed to UAC-0212 and the BACKORDER downloader, with some reports linking related activity to Sandworm sub-clusters UAC-0125. The campaign was first detected in May 2025 and highlights ongoing Russian cyber operations targeting Ukraine through sophisticated social engineering and malware delivery techniques.
Jun 29, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026