Ukrainian entities have fallen victim to a sophisticated phishing campaign distributing the Remcos remote access trojan. According to Cisco Talos researcher Guilherme Venere, the attackers use Russian language file names referencing troop movements in Ukraine as bait, with the malware contacting geo-fenced servers in Russia and Germany to download secondary payloads.
Security researchers have attributed this campaign with moderate confidence to Gamaredon, a Russian hacking group also known by multiple aliases including Aqua Blizzard, Armageddon, and Shuckworm. This FSB-affiliated threat actor has been conducting espionage and data theft operations against Ukrainian organizations since at least 2013.
The attack chain begins with ZIP archives containing Windows shortcut (LNK) files disguised as Microsoft Office documents related to the Russo-Ukrainian war. These files, likely distributed via phishing emails, contain PowerShell code that downloads additional malicious components while displaying decoy documents to victims.
The final payload is delivered through DLL side-loading techniques, where a loader DLL decrypts and executes the Remcos RAT from encrypted files within the archive.
In a parallel development, Silent Push has uncovered another phishing campaign targeting Russian individuals sympathetic to Ukraine. This operation impersonates various organizations including the CIA, Russian Volunteer Corps, Legion Liberty, and the “I Want to Live” surrender hotline. Hosted on bulletproof infrastructure, these phishing sites collect personal information and political views from victims, suggesting the involvement of Russian intelligence services or aligned threat actors.
## Cyber Security Threats in the Russia-Ukraine Conflict
The cyber dimension of the Russia-Ukraine conflict continues to evolve, with sophisticated phishing campaigns targeting both Ukrainian entities and Russian citizens with pro-Ukrainian sympathies. These operations demonstrate the ongoing use of cyber espionage tactics in the broader geopolitical conflict.