Loading story…
State-sponsored threat groups used Russia-Ukraine war-themed phishing documents to conduct cyber-espionage campaigns across Latin America, the Middle East, and South Asia. Check Point Research reported that El Machete targeted financial and government organizations in Nicaragua and Venezuela with malicious Word files that delivered Python-based malware, including a customized Loki.Rat variant and a second-stage JavaOracle payload, while Lyceum targeted the energy sector in Israel and likely Saudi Arabia using war-related decoys and droppers to install .NET DNS, .NET TCP, and Golang HTTP backdoors.
In South Asia, SideWinder targeted Pakistani entities with a Russia-Ukraine-themed lure that used remote template injection and exploited CVE-2017-11882 to deploy its long-running .NET infostealer. The activity showed how espionage-focused actors quickly adapted a major geopolitical crisis into convincing spear-phishing content to improve targeting and compromise government, financial, and energy-sector victims.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
The report describes Lyceum as an Iranian APT group that has been active since at least 2017, focused on cyberespionage against sectors of strategic importance.
An Israeli energy company received a Lyceum phishing email with the subject "Russian war crimes in Ukraine," linking to a decoy document hosted on attacker-controlled infrastructure. The campaign deployed multiple payload families, including .NET DNS, .NET TCP, and Golang HTTP backdoors, and likely also targeted Saudi Arabia.
Check Point observed El Machete targeting financial organizations in Nicaragua with a malicious Word document themed around Ukraine, and assessed that the activity likely extended to government entities in Venezuela. The infection chain deployed Python-based malware including a customized Loki.Rat variant and a second-stage JavaOracle payload.
Check Point Research reported that multiple state-sponsored groups used the Russia-Ukraine war as a lure in spear-phishing campaigns targeting victims in Latin America, the Middle East, and South Asia. The report identifies El Machete, Lyceum, and SideWinder and assesses the activity as espionage-focused.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 78 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Cyber operations tied to Russia’s invasion of Ukraine ranged from destructive malware and espionage to broader disruption against Ukrainian and allied targets. Researchers and government agencies documented **WhisperGate**, **HermeticWiper**, **CaddyWiper**, **DoubleZero**, and **FoxBlade** activity against Ukrainian networks, while Microsoft said it seized seven **Strontium** domains used to target Ukrainian institutions, media, and foreign-policy organizations in the U.S. and EU. Talos also reported a campaign against a Ukrainian software developer using a modified **GoMet** backdoor, raising supply-chain concerns, and Symantec described sustained **Shuckworm/Gamaredon** espionage using multiple **Pterodo** variants for persistence. Later reporting warned that Russian operations were expanding beyond Ukraine to logistics, transportation, defense, and energy organizations supporting Kyiv, including activity in Poland and across Europe’s defense supply chain.
Aug 15, 2026
Kaspersky reported that several interconnected pro-Ukrainian hacktivist groups, including **4BID**, **Hacker kiт**, **C.A.S**, and **Goffee**, expanded attacks beyond Russia and Belarus to targets in **Kazakhstan, the UAE, Syria, and Egypt**. Victims included government entities, healthcare organizations, and the aviation sector. Researchers said the intrusions commonly began with exploitation of Microsoft Exchange **ProxyShell** vulnerabilities, followed by deployment of the `fd.aspx` ASP.NET web shell, execution of PowerShell or `cmd.exe`, reconnaissance, and installation of remote-management tools such as AnyDesk, Dev Tunnels, Panorama9, Tactical RMM, and Nezha Monitoring. The campaigns used a broad post-compromise toolkit that mixed public C2 frameworks and custom malware, including **Sliver**, **Havoc**, **Mythic Apollo**, **AdaptixC2**, **BlackSalt** backdoor, **Warp RAT**, **BlackReaperRAT**, **ClearWater** ransomware, and an updated **Blackout Locker**. Investigators also observed BYOVD-based EDR killers, including modified EDRKiller variants and GhostDriver, along with signs that some delivery scripts may have been AI-generated. ClearWater was seen encrypting files with **ChaCha20** and **RSA-2048**, dropping ransom notes, changing wallpapers, and deleting recovery artifacts, while Blackout Locker added a persistent screen-locking feature, reinforcing researchers' assessment that the actors are shifting from politically branded hacktivism toward financially motivated operations.
Jun 29, 2026