Threats Affecting Ukraine

Cisco Talos identified a malware infection chain involving WebDAV-based DLL execution delivering the Amatera stealer and secondary payloads including ZigCryptoStealer and NetSupport Manager. The infection chain uses a Cloudflare Worker to inject JavaScript stored on BNB Smart Chain and a fake CAPTCHA prompt to trick victims into executing the malware. Two distinct DLL loaders named "verification.google" and "pf.ch" were observed, each deploying different secondary payloads. The "verification.google" loader installed NetSupport Manager with a command-and-control server IP linked to Russia, suggesting a Russian threat actor. The infection was first observed in April 2026 targeting a Ukrainian government organization but is assessed as not specifically targeted. Multiple infection chains delivering Amatera stealer have been documented, but no direct infrastructure links were found between them. The threat involves credential and cryptocurrency theft through sophisticated multi-stage delivery mechanisms.

HighMalwareUnited StatesBrazilBritish Indian Ocean Territory+4#windows#cisco#javascript

Manic is a newly discovered Android malware family that steals banking credentials, intercepts sensitive data, and allows remote control of infected devices. It uniquely exfiltrates stolen data even without an internet connection by exploiting Android Accessibility services to capture keystrokes and replay them on targeted apps. The malware targets banking apps, government apps, crypto wallets, and two-factor authentication apps across multiple European countries. Infection vectors likely include unofficial app stores, malicious APKs, and phishing links, with no evidence of distribution via Google Play. Manic abuses Accessibility permissions to spy on users, grant itself additional permissions, and prevent removal. It overlays an invisible keyboard to capture passwords and sensitive input. The malware has been active since at least May 2026 and continues to evolve to evade detection.

HighMalwareAustriaCzechiaEstonia+10#android#mobile#malware

Three implants named SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS have been found embedded in ZBT router firmware distributed globally, including in the US, Canada, Australia, Philippines, Germany, and Russia. DARKLANTERN is an unauthenticated UDP backdoor on port 9992 providing root shell access with trivial MAC address bypass. SPEAKINGSTONE is a phone-home implant capable of DNS hijacking, ISP credential theft, and remote command execution. These implants use plaintext protocols without authentication, making them vulnerable to hijacking by network adversaries. The compromised hardware is found in white-labeled consumer products sold through mainstream retailers, representing embedded surveillance capabilities in commercial devices. A sinkholed backup domain revealed 392 devices, mostly in China, and internet scans found 203 DARKLANTERN instances in 22 countries.

MediumMalwareUnited StatesAustraliaCanada+8#firmware implants#phone-home implant#darklantern

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18303.

HighVulnerabilityUnited StatesGermanyFrance+10#remote#rce#gcve

Three suspected Russian cyber espionage clusters—UNC6293, UNC7005, and UNC5976—target individuals in academia, aerospace, defense, governments, and think tanks in Europe and the US. They use sophisticated phishing techniques including app password phishing, OAuth phishing, device code phishing, and malware deployment. UNC6293 and UNC7005 are linked with moderate confidence to ICE RELIC (APT29), while UNC5976 is distinct. Their operations involve social engineering tactics such as fake diplomatic invitations and conference registrations. They abuse legitimate authentication mechanisms like Google OAuth and Microsoft device codes, complicating detection.

MediumCampaignUnited StatesArmeniaFinland+1#russian cyber espionage#oauth phishing#vidar

Operation CameraSwarm targeted Dahua cameras across multiple countries, focusing on Russian and CIS telecom netblocks. The post Threat Actor Hacks 14,000 IP Cameras in Ukraine and Russia appeared first on SecurityWeek .

MediumThreat ActorUkraineRussia

A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global fintech and cryptocurrency services. Active since February 2026, Manic enables extensive Device Takeover operations through sophisticated surveillance and remote-control features. It employs advanced PIN stealing techniques without requiring traditional overlay attacks, utilizing Accessibility services as a UI keylogger to capture lock-screen inputs, recovery phrases, and authentication codes. A distinctive feature is its Wi-Fi mesh egress technique, allowing compromised devices to relay stolen data through other infected phones via Wi-Fi Direct, Bluetooth, or BLE when direct C2 access is unavailable. The malware monitors 169 applications including banks, cryptocurrency wallets, government eID services, and military-focused messengers across multiple countries.

MediumMalwareAustriaCzechiaEstonia+9#wi-fi mesh relay#ukraine targeted#android

A sophisticated backdoor disguised as a legitimate Malwarebytes installer was distributed to over 100,000 machines through compromised automatic updates of one torrent client (Download Studio) and three adblockers (NetShield Kit, My AdBlock, and Net AdBlock). The backdoor creates a fake Malwarebytes installation directory containing legitimate signed files alongside malicious DLL files. Once executed, it establishes persistence through a Windows service and communicates with command-and-control servers to receive configuration updates and additional payloads. The primary observed payloads were cryptocurrency miners, though the infrastructure supports delivery of multiple persistent threats. The attack demonstrates abuse of software update mechanisms and affects primarily users in Russia, Ukraine, and Kazakhstan.

MediumMalwareKazakhstanRussiaUkraine#download studio#cryptocurrency mining#software update abuse

A persistent cyberespionage campaign tracked as CL-STA-1114, overlapping with Russian threat actor activity known as Void Blizzard and LAUNDRY BEAR, has been targeting Zimbra webmail in government, defense, transportation, and financial organizations. The campaign focuses on NATO member states, Ukraine, Commonwealth of Independent States countries, and Africa. Attackers exploit CVE-2025-66376, a vulnerability in Zimbra Collaboration Suite, using zero-click phishing emails that automatically inject malicious JavaScript payloads without user interaction. The payload exfiltrates sensitive data including login credentials, email archives, CSRF tokens, 2FA scratch codes, and 90 days of email history to command and control servers. Active since 2024, the campaign targeting Zimbra servers began in July 2025, utilizing HTML attachments with obfuscated Base64-encoded scripts that deploy SVG elements to inject the JavaScript into victims' browsers.

HighVulnerabilityUnited StatesUnited KingdomGermany+10#cve#cve-2025-66376#cwe-79

Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials. The post Russian Global Webmail Espionage appeared first on Unit 42 .

MediumCampaignUkraine#web#java#javascript