Loading story…
A long-running cyber-espionage campaign dubbed Operation Potao Express targeted high-value victims in Ukraine and neighboring countries with the Win32/Potao malware family and a trojanized version of TrueCrypt detected as Win32/FakeTC. Reported victims included Ukrainian government and military organizations, a major Ukrainian news agency, and members of the MMM Ponzi scheme, while additional targeting was observed in Russia, Belarus, and Georgia. The operation had been active since at least 2011, with intrusion attempts still being detected years later.
The attackers relied on simple but effective delivery methods, including personalized SMS lures, fake postal tracking pages, USB propagation, and executables disguised as Microsoft Word and Excel files. A standout tactic was the use of the domain truecryptrussia.ru, which allegedly served legitimate software to ordinary visitors but delivered a backdoored TrueCrypt build to selected targets. That malicious build was used both to install Potao and to steal files from encrypted drives, with activation designed to avoid detection and focus on long-term TrueCrypt users.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On 30 July 2015, ESET researchers Robert Lipovsky and Anton Cherepanov published their analysis of Operation Potao Express, detailing the Potao and FakeTC malware families, infection vectors, and affected targets. The publication also pointed readers to indicators of compromise in the whitepaper and on ESET's GitHub repository.
ESET said it was still detecting recent infiltration attempts involving Win32/Potao in July 2015, indicating the espionage operation remained active at that time.
ESET reported that the earliest detections of the Win32/Potao malware family dated back to 2011, marking the start of the long-running espionage activity later dubbed Operation Potao Express.
The campaign deployed a backdoored TrueCrypt build from truecryptrussia.ru to selected targets while serving clean software to ordinary visitors. ESET identified this malware as Win32/FakeTC, which was used both to deliver Potao and to steal files from encrypted drives.
At some point during the campaign, the attackers shifted focus from Russia to Ukraine and used personalized SMS lures that led victims to fake postal tracking pages hosting malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET detailed **Operation Potao Express**, a long-running cyber-espionage campaign built around the `Win32/Potao` malware family and, in some cases, a trojanized TrueCrypt variant tracked as `Win32/FakeTC`. The activity was first observed in 2011 and targeted victims primarily in **Ukraine, Russia, and Georgia**, including Ukrainian government, military, and media organizations as well as members of the MMM Ponzi scheme. Researchers said the operation relied heavily on **social engineering** rather than software exploits, using phishing emails, spear-phishing SMS messages, fake postal-service websites, malicious executables disguised as documents, and USB-based propagation. The malware functioned as a modular espionage toolkit with plugins for **system profiling, file theft, password theft, screenshots, and keylogging**, while command-and-control traffic was protected with `RSA-2048` and `AES-256`. ESET also found that `truecryptrussia.ru` selectively served backdoored TrueCrypt downloads to chosen victims and simultaneously acted as command-and-control infrastructure, reinforcing the view that the campaign was professionally run and highly selective. The report did not make a definitive attribution, but said the malware was probably of **Russian origin** and highlighted several high-value Ukrainian targets among the victims.
Aug 14, 2026
Researchers detailed **KPOT v2.0**, a commercially sold information-stealing malware strain designed to harvest credentials and sensitive data from browsers, messaging applications, email clients, VPN and RDP software, FTP clients, gaming platforms, and cryptocurrency wallets including **Jaxx**. The malware was marketed on underground forums at a low price point, making it accessible to a broad range of threat actors, and its targeting of wallet users highlighted the growing overlap between credential theft and cryptocurrency-focused crime. Observed delivery methods included email campaigns and exploit kits, including an RTF lure exploiting **`CVE-2017-11882`** to launch a PowerShell-based loader that retrieved the final payload. Once executed, KPOT used encrypted strings, runtime API resolution, and an encrypted HTTP command-and-control configuration to receive tasks, exfiltrate system and credential data, and steal files matching attacker-defined rules. The analyzed variant notably used **in-memory execution** and **no persistence**, terminating after completing assigned tasks, and also checked for victims in CIS countries before exiting without infecting them.
Aug 15, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026