ukr[.]net

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new phishing campaign in which the cybersecurity agency itself was impersonated to distribute a remote administration tool known as AGEWHEEZE. As part of the attacks, the threat actors, tracked as UAC-0255, sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm and urged recipients to install the "specialized software." The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address "incidents@cert-ua[.]tech." The ZIP file ("CERT_UA_protection_tool.zip") is designed to download malware packaged as security software from the agency. The malware, per CERT-UA, is a remote access trojan codenamed AGEWHEEZE. A Go-based malware, AGEWHEEZE communicates with an external server ("54.36.237[.]92") over WebSockets and supports a wide range of commands to execute commands, perform file operations, modify the clipboard, emulate mouse and keyboard, take screenshots, and manage processes and services. It also creates persistence by using a scheduled task, modifying the Windows Registry, or adding itself to the Startup directory. The attack is assessed to have been largely unsuccessful. "No more than a few infected personal devices belonging to employees of educational institutions of various forms of ownership were identified," the agency said. "The team's specialists provided the necessary methodological and practical assistance." An analysis of the bogus website "cert-ua[.]tech" has revealed that it was likely generated with assistance from artificial intelligence (AI) tools, with the HTML source code also including a comment: "С Любовью, КИБЕР СЕРП," meaning "With Love, CYBER SERP." In posts on Telegram, Cyber Serp claims that they are "cyber-underground operatives from Ukraine." The Telegram channel was created in November 2025 and has more than 700 subscribers. The threat actor also said the phishing emails were sent to 1 million ukr[.]net mailboxes as part of the campaign, and that over 200,000 devices have been compromised. "We are not bandits – the average Ukrainian citizen will never suffer as a result of our actions," it said in a post. Last month, Cyber Serp took responsibility for an alleged breach of Ukrainian cybersecurity company Cipher, stating it obtained a complete dump of the servers, including a client database and source code for their line of CIPS products, among others. In a statement on its website, Cipher acknowledged that attackers compromised the credentials of an employee at one of its technology companies but said its infrastructure was operating normally. The infected user had access to a single project, which did not contain sensitive data, it added.

Cybersecurity researchers have disclosed details of a new Russian cyber campaign that has targeted Ukrainian entities with two previously undocumented malware families named BadPaw and MeowMeow. "The attack chain initiates with a phishing email containing a link to a ZIP archive. Once extracted, an initial HTA file displays a lure document written in Ukrainian concerning border crossing appeals to deceive the victim," ClearSky said in a report published this week. In parallel, the attack chain leads to the deployment of a .NET-based loader called BadPaw, which then establishes communication with a remote server to fetch and deploy a sophisticated backdoor called MeowMeow. The campaign has been attributed with moderate confidence to the Russian state-sponsored threat actor known as APT28, based on the targeting footprint, the geopolitical nature of the lures used, and overlaps with techniques observed in previous Russian cyber operations. The starting point of the attack sequence is a phishing email sent from ukr[.]net, likely in an attempt to establish credibility and secure the trust of targeted victims. Present in the message is a link to a purported ZIP file, causing the user to be redirected to a URL that loads an "exceptionally small image," effectively acting as a tracking pixel to signal the operators that the link was clicked. Once this step is complete, the victim is redirected to a secondary URL from where the archive is downloaded. The ZIP file includes an HTML Application (HTA) that, once launched, drops a decoy document as a distraction mechanism, while it executes follow-on stages in the background. "The dropped decoy document serves as a social engineering tactic, presenting a confirmation of receipt for a government appeal regarding a Ukrainian border crossing," ClearSky said. "This lure is intended to maintain the veneer of legitimacy." The HTA file also carries out checks to avoid running within sandbox environments. It does this by querying the Windows Registry key "KLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate" to estimate the "age" of the operating system. The malware is designed to abort execution if the system was installed less than ten days prior. Should the system meet the environment criteria, the malware locates the downloaded ZIP archive and extracts two files from it – a Visual Basic Script (VBScript) and a PNG image – and saves them to disk under different names. It also creates a scheduled task to execute the VBScript as a way of ensuring persistence on the infected system. The primary responsibility of the VBScript is to extract malicious code embedded within the PNG image, an obfuscated loader referred to as BadPaw that's capable of contacting a command-and-control (C2) server to download additional components, including an executable named MeowMeow. "Consistent with the 'BadPaw' tradecraft, if this file is executed independently of the full attack chain, it initiates a dummy code sequence," the Israeli cybersecurity company explained. "This decoy execution displays a graphical user interface (GUI) featuring a picture of a cat, aligning with the visual theme of the initial image file from which the primary malware was extracted." "When the 'MeowMeow' button within the decoy GUI is clicked, the application simply displays a 'Meow Meow Meow' message, performing no further malicious actions. This serves as a secondary functional decoy to mislead manual analysis." The backdoor's malicious code is activated only when it's executed with a certain parameter ("-v") that's provided by the initial infection chain, and after checking that it's running on an actual endpoint as opposed to a sandbox, and no forensic and monitoring tools like Wireshark, Procmon, Ollydbg, and Fiddler are running in the background. At its core, MeowMeow is equipped to remotely execute PowerShell commands on the compromised host and support file system operations, such as the ability to read, write, and delete data. ClearSky said it identified Russian language strings in the source code, reinforcing the assessment that the activity is the work of a Russian-speaking threat actor. "The presence of these Russian-language strings suggests two possibilities: the threat actor committed an operational security (OPSEC) error by failing to localize the code for the Ukrainian target environment, or they inadvertently left Russian development artifacts within the code during the malware's production phase," it said.

A newly identified malware campaign leveraging a Ukrainian email service to build credibility has been uncovered by cybersecurity researchers. The operation begins with an email sent from an address hosted on ukr[.]net, a popular Ukrainian provider previously abused by the Russian-linked threat actor APT28 in past campaigns. According to an advisory by researchers at ClearSky, who have named the malware "BadPaw," the attack is triggered when a recipient clicks a link claiming to host a ZIP archive. Instead of initiating a direct download, the victim is redirected to a domain that loads a tracking pixel, allowing the attacker to confirm engagement. A second redirect then delivers the ZIP file. Although the archive appears to contain a standard HTML file, ClearSky researchers found it is actually an HTA application in disguise. Once executed, the file displays a decoy document referencing a Ukrainian government border crossing appeal, while malicious processes run in the background. Before proceeding, the malware checks a Windows Registry key to determine the system's installation date. If the operating system is less than ten days old, execution stops, a tactic designed to avoid sandbox environments used by security analysts. If conditions are met, the malware searches for the original ZIP file and extracts additional components. Persistence is achieved through a scheduled task that runs a VBS script, which uses steganography to extract hidden executable code from an image file. Only nine antivirus engines detected the payload at the time of analysis. Multi-Layered Backdoor and Attribution Once activated with a specific parameter, BadPaw connects to a command-and-control (C2) server. The staged communication process includes: Retrieving a numeric response from the /getcalendar endpoint Accessing a landing page titled "Telemetry UP!" via /eventmanager Downloading ASCII-encoded payload data embedded within HTML The decoded data ultimately deploys a backdoor named "MeowMeowProgram[.]exe," which provides remote shell access and file system control. The MeowMeow backdoor incorporates four defensive layers, including runtime parameter requirements, .NET Reactor obfuscation, sandbox detection and monitoring for forensic tools such as Wireshark, Procmon, Ollydbg and Fiddler. If executed incorrectly, it displays a benign graphical interface featuring a cat image. Clicking the "MeowMeow" button simply generates a harmless message. ClearSky also identified Russian-language strings embedded in the code. One translated line reads: "Time to reach working/operational condition: (\d+) seconds." According to ClearSky, these artifacts may indicate a Russian-speaking developer or an operational oversight in failing to localize the malware for Ukrainian targets.

Russian state-sponsored threat actors have been linked to a fresh set of credential harvesting attacks targeting individuals associated with a Turkish energy and nuclear research agency, as well as staff affiliated with a European think tank and organizations in North Macedonia and Uzbekistan. The activity has been attributed to APT28 (aka BlueDelta), which was tied to a "sustained" credential-harvesting campaign targeting users of UKR[.]net last month. APT28 is associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). "The use of Turkish-language and regionally targeted lure material suggests that BlueDelta tailored its content to increase credibility among specific professional and geographic audiences," Recorded Future's Insikt Group said. "These selections reflect a continued interest in organizations connected to energy research, defense cooperation, and government communication networks relevant to Russian intelligence priorities." The cybersecurity company described the attacks as targeting a small but distinct set of victims in February and September 2025, with the campaign leveraging fake login pages that were styled to resemble popular services like Microsoft Outlook Web Access (OWA), Google, and Sophos VPN portals. The efforts are noteworthy for the fact that unsuspecting users are redirected to the legitimate sites after the credentials are entered on the bogus landing pages, thereby avoiding raising any red flags. The campaigns have also been found to lean heavily on services like Webhook[.]site, InfinityFree, Byet Internet Services, and ngrok to host the phishing pages, exfiltrate stolen data, and enable redirections. In a further attempt to lend them a veneer of legitimacy, the threat actors are said to have used legitimate PDF lure documents, including a publication from the Gulf Research Center related to the June 2025 Iran-Israel war and a July 2025 policy briefing calling for a new pact for the Mediterranean released by climate change think tank ECCO. The attack chain starts with a phishing email containing a shortened link that, when clicked, redirects victims to another link hosted on webhook[.]site, which briefly displays the decoy document for about two seconds before redirecting to a second webhook[.]site that hosts a spoofed Microsoft OWA login page. Present within this page is a hidden HTML form element that stores the webhook[.]site URL and uses JavaScript to send a "page opened" beacon, transmit the submitted credentials to the webhook endpoint, and ultimately redirect back to the PDF hosted on the actual website. APT28 has also been observed conducting three other campaigns - A June 2025 campaign that deployed a credential-harvesting page mimicking a Sophos VPN password reset page hosted on infrastructure provided by InfinityFree to harvest credentials entered into the form and redirect victims to a legitimate Sophos VPN portal belonging to an unnamed E.U. think tank A September 2025 campaign that used credential-harvesting pages hosted on InfinityFree domains to falsely warn users of expired passwords to trick them into entering their credentials and redirect to a legitimate login page associated with a military organization in the Republic of North Macedonia and an IT integrator based in Uzbekistan An April 2025 campaign that used a fake Google password reset page hosted on Byet Internet Services to gather victims' credentials and exfiltrate them to an ngrok URL "BlueDelta's consistent abuse of legitimate internet service infrastructure demonstrates the group’s continued reliance on disposable services to host and relay credential data," the Mastercard-owned company said. "These campaigns underscore the GRU’s sustained commitment to credential harvesting as a low-cost, high-yield method of collecting information that supports Russian intelligence objectives."

The Russian state-sponsored threat actor known as APT28 has been attributed to what has been described as a "sustained" credential-harvesting campaign targeting users of UKR[.]net, a webmail and news service popular in Ukraine. The activity, observed by Recorded Future's Insikt Group between June 2024 and April 2025, builds upon prior findings from the cybersecurity company in May 2024 that detailed the hacking group's attacks targeting European networks with the HeadLace malware and credential-harvesting web pages. APT28 is also tracked as BlueDelta, Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422. It's assessed to be affiliated with Russia's Main Directorate of the General Staff of the Russian Federation's Armed Forces (GRU). The latest attacks are characterized by the deployment of UKR[.]net-themed login pages on legitimate services like Mocky to entice recipients into entering their credentials and two-factor authentication (2FA) codes. Links to these pages are embedded within PDF documents that are distributed via phishing emails. The links are shortened using services like tiny[.]cc or tinyurl[.]com. In some cases, the threat actor has also been observed using subdomains created on platforms like Blogger (*.blogspot[.]com) to launch a two-tier redirection chain that leads to the credential harvesting page. The efforts are part of a broader set of phishing and credential theft operations orchestrated by the adversary since mid-2000s targeting government institutions, defense contractors, weapons suppliers, logistics firms, and policy think tanks in pursuit of Russia's strategic objectives. "While this campaign does not reveal specific targets, BlueDelta's historical focus on credential theft to enable intelligence collection provides strong indicators of likely intent to collect sensitive information from Ukrainian users in support of broader GRU intelligence requirements," the Mastercard-owned company said in a report shared with The Hacker News. What has changed is the transition from using compromised routers to proxy tunneling services such as ngrok and Serveo to capture and relay the stolen credentials and 2FA codes. "BlueDelta's continued abuse of free hosting and anonymized tunneling infrastructure likely reflects an adaptive response to Western-led infrastructure takedowns in early 2024," Recorded Future said. "The campaign highlights the GRU's persistent interest in compromising Ukrainian user credentials to support intelligence-gathering operations amid Russia's ongoing war in Ukraine."

For the latest discoveries in cyber research for the week of 11th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Air France has experienced a data breach that resulted in unauthorized access to customer data through a compromised external customer service platform. The attack exposed personal information, including names, email addresses, phone numbers, frequent flyer program details, and recent transactions, but did not affect customer financial or sensitive personal data. Google has suffered a data breach that resulted in the exposure of approximately 2.55 million business contact records from its Salesforce CRM, including business names, phone numbers, and sales notes of potential Google Ads customers. The attack is linked to ShinyHunters and possibly to Scattered Spider, who extorted Google and threatened to leak the stolen data. Bouygues Telecom, a French internet service provider, has confirmed a cyberattack that resulted in unauthorized access to personal data from 6.4 million customer accounts. The data breach affected a segment of its mobile and fiber-to-the-home customers, exposing limited personal data. Pandora, a Danish jewelry manufacturer and retailer, has suffered a data breach that resulted in the theft of customer names, birthdates, and email addresses from its Salesforce database. The breach impacted the personal information of customers, but no passwords, IDs, or financial data were exposed. The US Federal Judiciary has confirmed a cyber attack that resulted in unauthorized access to its electronic case management systems, exposing confidential court documents including sensitive sealed filings and potentially the identities of confidential informants. American Public Broadcasting Service (PBS) has suffered a data breach that resulted in the exposure of corporate contact information for 3,997 employees and affiliates, including names, corporate emails, job titles, departments, locations, hobbies, and supervisor names. Pakistan Petroleum Limited (PPL) has experienced a cyber-attack that resulted in its IT systems being crippled, with servers encrypted, backups blocked, and financial operations suspended for two days. Vital data—encompassing operational records, contracts, and employee information—was exfiltrated and is now being held hostage. Blue Locker claimed responsibility for the attack. The University of Western Australia has suffered a data breach that resulted in unauthorized access to password information of thousands of staff members and students. The incident forced a lockout of all users and mandatory password resets, with no evidence that any other data or systems were compromised. VULNERABILITIES AND PATCHES Check Point Research has identified a persistent remote code execution vulnerability in the Cursor IDE, tracked as CVE-2025-54136. The vulnerability is caused by insufficient validation of Model Context Protocol (MCP) configuration changes. After a user’s initial approval of a benign MCP plugin, attackers with write access can modify MCP commands to execute arbitrary or malicious code on victims’ machines each time the project is opened, without any further prompts or interaction. Cisco has disclosed five critical vulnerabilities in Dell ControlVault3 firmware and its associated Windows APIs, collectively named “ReVault.” These flaws (CVE-2025-24311, CVE-2025-25050, CVE-2025-25215, CVE-2025-24922, CVE-2025-24919) enable attackers to achieve arbitrary code execution, persistent firmware implants, and privilege escalation, potentially bypassing Windows authentication and persisting across OS reinstalls. Trend Micro has released an advisory addressing vulnerabilities CVE-2025-54987 and CVE-2025-54948, two critical severity Remote Code Execution vulnerabilities (9.4 CVSS) in Trend Micro Apex One management console. The vulnerabilities have been actively exploited in the wild. THREAT INTELLIGENCE REPORTS Researchers have analyzed recent updates to Raspberry Robin, a sophisticated malware downloader active since 2021, revealing advanced obfuscation techniques and improvements in network encryption, such as a transition from AES-CTR to ChaCha-20 and the introduction of per-request randomized counters and nonces. The malware now utilizes obfuscated stack pointers, complex initialization loops to hinder brute-force decryption, modified RC4 key structures, and employs a new local privilege escalation exploit (CVE-2024-38196). Check Point Threat Emulation and Harmony Endpoint provide protection against this threat (Trojan.Wins.RaspberryRobin.ta.*, Trojan.Wins.RaspberryRobin.*) Researchers have uncovered a novel AV-killer malware abusing the legitimate ThrottleStop.sys driver (CVE-2025-7771), used in the wild since at least October 2024. This malware, delivered alongside the vulnerable driver, leverages two exposed IOCTL interfaces to perform arbitrary physical memory reads and writes via MmMapIoSpace, enabling privileged kernel-level calls to locate and terminate a wide range of antivirus and EDR processes. Ukrainian Computer Emergency Response Team (CERT-UA) has analyzed a wave of cyber-espionage attacks by UAC-0099, leveraging a court-summons phishing lure. These attacks begin with phishing emails sent via UKR.NET that deliver HTA files containing obfuscated VBScript, which drop files, create scheduled tasks, and deploy the MATCHBOIL C# loader—followed by the MATCHWOK backdoor and DRAGSTARE stealer.