CampaignPublished 10 Nov 2025

OSINT - PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Impact

For European organizations, the primary impact stems from indirect exposure due to geopolitical ties with Ukraine, such as governmental agencies, NGOs, critical infrastructure providers, and companies with business interests in the region. Successful compromise could lead to espionage, data theft, or disruption of operations, particularly in sectors supporting Ukrainian defense or humanitarian efforts. The use of WebSocket RATs complicates detection and may allow attackers to maintain long-term access, increasing risk of data leakage or sabotage. Additionally, organizations hosting Ukrainian diaspora or involved in information sharing with Ukrainian entities may be targeted or collateral victims. The campaign's spearphishing vector means that user awareness and email security are critical; failure here could lead to initial compromise and subsequent network infiltration. While the campaign currently focuses on Ukraine, the techniques and malware could be adapted or expanded to other European targets, especially those with strategic importance in the ongoing conflict or political landscape.

Defensive guidance

1. Implement advanced email filtering solutions that detect and quarantine spearphishing attempts, including those using impersonation tactics. 2. Conduct targeted user awareness training emphasizing recognition of spearphishing and social engineering, particularly for employees in sensitive roles or with access to critical systems. 3. Deploy network monitoring tools capable of inspecting WebSocket traffic for anomalous patterns indicative of RAT command and control. 4. Utilize endpoint detection and response (EDR) solutions configured to identify multi-stage malware behaviors and unusual process activities. 5. Enforce strict application whitelisting and restrict execution of unauthorized scripts or binaries. 6. Establish network segmentation to limit lateral movement if a compromise occurs. 7. Collaborate with threat intelligence providers to obtain updated indicators of compromise and share relevant findings with trusted partners. 8. Regularly review and update incident response plans to address sophisticated multi-stage attacks involving WebSocket communications. 9. For organizations supporting Ukraine, implement additional security controls around data sharing and remote access services. 10. Monitor geopolitical developments to anticipate shifts in targeting or tactics by threat actors like Callisto.

Indicators of compromise

Domains 14

lapas.livePhantomCaptcha
zoomconference.appPhantomCaptcha
zoomconference.clickPhantomCaptcha
princess-mens.clickAndroid Malware
princess-mens-club.comAndroid Malware
bsnowcommunications.comPhantomCaptcha
goodhillsenterprise.comPhantomCaptcha
zoomconference.app
zoomconference.app
assets.msn.com-ion.edgesuite.net

URLs 3

https://zoomconference.app/?conferenceId=fjZlk9qn10CbFjgQobL
https://princess-mens.click/K-Lite_Codec_Pack_1905_Basic.rar
https://princess-mens.click/princess.apk

IP addresses 8

45.15.156.24PhantomCaptcha
185.142.33.131PhantomCaptcha
193.233.23.81PhantomCaptcha
91.149.253.99Android Malware
91.149.253.134Android Malware
167.17.188.244Android Malware
185.142.33.131PhantomCaptcha
45.15.156.24PhantomCaptcha

Hashes 14

07d9deaace25d90fc91b31849dfc12b2fc3ac5ca90e317cfa165fe1d3553eeadCloud Storage
e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3The campaign was initiated through emails that impersonated the Ukrainian President’s Office and contained a weaponized PDF attachment (SHA-256: e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3) embedded with a malicious link.
3324550964ec376e74155665765b1492ae1e3bdeb35d57f18ad9aaca64d50a44The initial payload (SHA-256: 3324550964ec376e74155665765b1492ae1e3bdeb35d57f18ad9aaca64d50a44) was a heavily obfuscated PowerShell script named cptch and exceeding 500KB in size. Despite its apparent complexity, the cptch script’s core functionality is simply to download and execute a second-stage payload from hxxps://bsnowcommunications[.]com/maintenance.
4bc8cf031b2e521f2b9292ffd1aefc08b9c00dab119f9ec9f65219a0fbf0f566Stage 2: Fingerprinting and Encrypted Comms The second-stage payload (SHA-256: 4bc8cf031b2e521f2b9292ffd1aefc08b9c00dab119f9ec9f65219a0fbf0f566) is named maintenance and performs system reconnaissance, collecting: Computer name Domain information Username Process ID System UUID (hardware identifier)
55677db95eb5ddcca47394d188610029f06101ee7d1d8e63d9444c9c5cb04ae1
b02d8f8cf57abdc92b3af2545f1e46f1813f192f4a200a3de102fd38cf048517
bcb9e99021f88b9720a667d737a3ddd7d5b9f963ac3cae6d26e74701e406dcdc
412196c2f6850998f9681341711aa863
2971f1235d8417a5bf271133915da26f1c958bb2
e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3

File 3

princess.apk
princess.apk
princess.apk

Link 2

https://www.virustotal.com/gui/file/e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3
https://www.virustotal.com/gui/file/3324550964ec376e74155665765b1492ae1e3bdeb35d57f18ad9aaca64d50a44

Text 14

23/65
app
/
conferenceId=fjZlk9qn10CbFjgQobL
zoomconference
21/64
b3yTKRaP4RHKYQMf0gMd4fw1KNvBtv3l
XOR
click
/K-Lite_Codec_Pack_1905_Basic.rar

Tlsh 2

t19c94d840dc889cdcf05be6837b6e5542ab6db107b2c951d138ae8ec3d282f1e579f192
t1f4b4bc603b6d9de4258e9cd1e510d21d33f91969f312221d0bcba6dce3834f1c75aaba

Vhash 2

9f38b3b15b2a572f69c335de9493092e8
f07eb0e08c28855a91f2394806462e48

Ssdeep 2

6144:OiNE5FEK4YblCKPIXbh7KfLM4tnJhaK6BDOqNbnjJ:jDuEKPIXb0fLfJDaK6BDOqdnjJ
1536:louFtHnamZ+9od+fWH83M/DAtjIbkbd0DwGWVnZlmX93g6eCApDzBOz20pEWJs8K:zYok8bt3gR+VDbHMZFyiS7f8V1SCyZo

Community reviews

Loading reviews…