This campaign delivers Rust-based malware via spear phishing emails targeting the unmanned aviation sector in Eurasia, timed with a major aviation forum in Moscow. The initial payload is disguised as legitimate aviation documents in Russian and collects system details such as hostnames, volume serial numbers, network adapter info, and environment variables. Data is encrypted with XOR and exfiltrated over HTTPS to a C2 server. Subsequently, a second-stage payload is downloaded and decrypted using AES-256 for execution. The attack uses multi-stage payloads and advanced social engineering with aviation order documents, translation certificates, and product summaries to increase credibility and target professionals in Russia, Tajikistan, Central Asia, the Middle East, and Europe.

The malware collects sensitive system information and exfiltrates it to an attacker-controlled server, potentially enabling further compromise through the downloaded second-stage payload. The campaign targets critical sectors related to unmanned aviation, which could impact operational security and confidentiality. No known exploits in the wild or direct destructive payloads are reported at this time.

No official patch or vendor advisory is available for this campaign. Organizations in the unmanned aviation sector should increase awareness of spear phishing threats, especially those timed with industry events. Users should be cautious of unsolicited emails containing archives or executables, even if they appear to be legitimate aviation documents. Network defenses should monitor for unusual HTTPS traffic to suspicious domains such as kleymarket.ru and related IP addresses. Incident response teams should use the provided indicators of compromise (hashes, IPs, domains) to detect and block this malware. Patch status is not yet confirmed — check vendor advisories for updates.