Loading story…
A joint advisory from CISA, NSA, FBI and allied agencies warns that Russia’s GRU Unit 26165, known as APT28, Fancy Bear and Forest Blizzard, has conducted cyberespionage against dozens of Western government and private-sector organizations supporting aid to Ukraine since 2022. Targets include air, sea and rail transportation providers, logistics companies and related technology services. Operators gain access through password spraying, credential-harvesting and malware-delivery spearphishing, and exploitation of internet-facing infrastructure, including VPNs. Reported exploited vulnerabilities include Outlook’s NTLM credential leak (CVE-2023-23397), several Roundcube flaws and WinRAR’s CVE-2023-38831. Follow-on reporting also identifies exploitation of CVE-2023-20273.
After compromise, operators steal credentials, conduct Active Directory reconnaissance, move laterally using Impacket, PsExec and RDP, and abuse Microsoft Exchange mailbox permissions for sustained email collection. They use legitimate utilities alongside malware such as HEADLACE and MASEPIE, clear event logs, and exfiltrate data through OpenSSH and email interfaces. The advisory links the campaign to targeting of more than 10,000 internet-connected cameras, concentrated in Ukraine and neighboring countries, to monitor aid movements; that figure represents targeted cameras, not confirmed compromises. Defenders should prioritize patching exposed services, strong authentication, privileged-access restrictions and segmentation, while hunting for abnormal mailbox permissions, credential theft, lateral movement and log clearing across endpoint, cloud and network telemetry. Persistent access could enable future disruption, but the reporting does not establish confirmed sabotage.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Since at least fall 2023, GRU unit 26165 exploited CVE-2023-38831 to execute code embedded in archives and obtain initial access to targeted organizations.
Since 2022, GRU unit 26165, also tracked as APT28, expanded its espionage targeting as Western countries increased assistance to Ukraine following Russia’s invasion. The campaign targeted dozens of government and private-sector organizations across transportation, logistics, and related technology services.
CISA, NSA, FBI, NCSC-UK, and other allied agencies issued a joint advisory attributing the campaign to GRU unit 26165. The advisory detailed exploitation of Outlook, Roundcube, and WinRAR vulnerabilities and published indicators, hunting guidance, and mitigations.
The joint advisory described large-scale targeting of internet-connected IP cameras in Ukraine and bordering countries, likely connected to the logistics espionage campaign. A dataset contained more than 10,000 targeted cameras, heavily concentrated in Ukraine, with the activity intended to monitor aid movement.
After compromise, operators moved laterally, attempted to dump Active Directory databases, and used Certipy and ADExplorer to extract directory information. They also altered Exchange and Office 365 mailbox permissions for sustained email collection and enrolled compromised accounts in MFA mechanisms to strengthen persistence.
The campaign included reconnaissance against at least one organization producing industrial control system components for railway management. A successful compromise of that organization was not confirmed.
The operators exploited trust relationships to pursue transportation-sector organizations with business ties to primary victims, extending the campaign beyond its initial targets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 100 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcelogpoint.com
Open sourcecisa.gov
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026
Ukrainian officials warned that Russia-linked hackers are revisiting earlier compromises to regain access to government and defense networks, testing whether old footholds, unpatched vulnerabilities, and previously stolen credentials still work. CERT-UA said the activity reflects a broader shift from smash-and-grab credential theft toward persistent access, with initial intrusion methods also evolving beyond phishing to more tailored social engineering, including phone calls and video chats in fluent Ukrainian before malicious files are delivered through messaging apps. Agencies tied the activity to groups including **APT28** and **Void Blizzard**, with the security and defense sector remaining the top target because disruptions there could affect the war effort. Ukraine also confirmed a long-running cyber-espionage campaign, tracked since 2023 and attributed by Western researchers to **APT28** (`Fancy Bear`, `BlueDelta`, `Forest Blizzard`), that targeted prosecutors, anti-corruption bodies, and other local government entities through **Roundcube** webmail vulnerabilities enabling code execution when a victim opened an email. Reuters reported that more than 170 email accounts belonging to prosecutors and investigators were compromised in recent months, and CERT-UA identified three waves of related attacks. Officials said some allegedly stolen material was later published online, though reviews indicated the leaks likely did not include confidential data, and warned the operation could still be used to fuel disinformation aimed at eroding trust in Ukrainian institutions.
Jun 29, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026