Loading story…
Google Threat Intelligence Group reported that suspected Russian operation UNC5812 used a hybrid espionage-and-influence campaign to target potential Ukrainian military recruits through a Telegram persona and a website branded "Civil Defense." Promoted posts in legitimate Ukrainian-language Telegram channels lured users to actor-controlled infrastructure that pushed anti-mobilization narratives, solicited videos alleging abuse by Ukrainian recruitment centers, and amplified messaging aligned with broader pro-Russian influence networks.
The operation also delivered malware to both Windows and Android users. Windows victims were led through a multi-stage infection chain involving Pronsis Loader—a JPHP-based malware family also documented by Trustwave as distinct from D3F@ck Loader—before deployment of PURESTEALER, while Android users were tricked into disabling Google Play Protect and granting permissions needed for CRAXSRAT; researchers also identified a decoy mapping application tracked as SUNSPINNER. Google said it added related files and infrastructure to Safe Browsing, relied on Play Protect protections, and shared findings with Ukrainian authorities, who blocked national resolution of the Civil Defense site.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Another Ukrainian-language news channel promoted Civil Defense posts, showing the operation was still being amplified through Telegram channels in October 2024.
A legitimate Ukrainian missile alert Telegram channel with more than 80,000 subscribers promoted the Civil Defense operation, helping drive users to actor-controlled infrastructure.
Google Threat Intelligence Group discovered UNC5812, which it assessed as a suspected Russian hybrid espionage and influence operation targeting Ukrainian military recruits.
The Telegram channel @civildefense_com_ua was created and later used as a lure hub for the operation's malware delivery and anti-mobilization messaging.
The actor-controlled Civil Defense website domain, civildefense[.]com.ua, was registered as part of the infrastructure later used to target potential Ukrainian military recruits.
Google added identified infrastructure and files to Safe Browsing, shared its findings with Ukrainian authorities, and Ukrainian authorities blocked national resolution of the Civil Defense website.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcetrustwave.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (GTIG) attributed a previously undocumented threat actor—assessed as **possibly affiliated with Russian intelligence services**—to phishing-led intrusions delivering **CANFAIL**, an obfuscated JavaScript malware used against Ukrainian organizations. Targeting has focused on **defense, military, government, and energy** entities, with reported expansion into aerospace, manufacturing tied to military/drone supply chains, nuclear/chemical research, and international organizations involved in conflict monitoring and humanitarian aid. GTIG reported the actor has begun using **LLMs** to compensate for limited sophistication, including generating reconnaissance outputs, crafting social-engineering lures, and seeking guidance for post-compromise actions and C2 setup. The observed infection chain uses **LLM-generated phishing lures** and **Google Drive** links that deliver a **RAR archive** containing CANFAIL, often disguised with a double extension such as `*.pdf.js` to appear benign. CANFAIL is designed to execute a **PowerShell** script to continue execution and enable follow-on activity. GTIG also noted regional spillover and related targeting, including impersonation of Ukrainian energy organizations and a Romanian energy company serving customers in Ukraine, plus activity against a Romanian firm and reconnaissance on Moldovan organizations; the actor reportedly builds tailored email lists by region and industry to support these campaigns.
Jun 29, 2026
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026
Researchers and government defenders linked **CredoMap**, a .NET credential-stealing malware family, to Russian state actor **APT28** in phishing campaigns targeting users and organizations in Ukraine during the Russia-Ukraine war. Google reported APT28 distributing the malware through Ukraine-themed lures in password-protected ZIP archives, while CERT-UA documented a malicious RTF file, **"Nuclear Terrorism A Very Real Threat.rtf"**, that exploited **`CVE-2022-30190`** (Follina) to fetch staged payloads from attacker-controlled or compromised infrastructure before launching the stealer. Broader reporting on wartime cyber activity also placed the operation alongside other Russian espionage and disruptive campaigns aimed at Ukrainian government, critical infrastructure, and regional defense targets. Technical analysis showed CredoMap harvesting browser credentials and cookies from **Google Chrome, Mozilla Firefox, and Microsoft Edge**, including decryption of Chromium secrets via **DPAPI** and **AES-GCM**, then exfiltrating the data to a hard-coded command-and-control server at **`162.241.216.236`** over **IMAP** on port **`143`** using embedded credentials. CERT-UA said the infection chain retrieved **`article.html`** from **`frge.io`** and additional files including **`SQLite.Interop.dll`** and **`docx.exe`** from **`kompartpomiar.pl`**, which was assessed as likely compromised. After collection, the malware removed copied artifacts, deleted supporting files, and self-deleted, underscoring a focused espionage operation designed to steal access and browsing data while minimizing forensic traces.
Aug 21, 2026