ClayRat is an Android spyware campaign primarily targeting Russian users by masquerading as popular apps distributed through Telegram channels and phishing sites. It exfiltrates SMS, call logs, notifications, device info, takes photos, and sends SMS messages. The malware spreads aggressively by sending malicious links to victims' contacts, leveraging Android's default SMS handler role to bypass permission prompts. Over 600 samples and 50 droppers have been observed in three months, with continuous obfuscation improvements. The campaign uses impersonation, community distribution, UX deception, and self-propagation via SMS forwarding. While currently focused on Russia, the techniques and propagation methods pose risks to European organizations with Android users. No known exploits are publicly reported, and the campaign requires user interaction to install and propagate. Suggested severity is medium due to its impact on confidentiality and propagation capabilities but limited to targeted regions and requiring user action.
New "Cavalry Werewolf" Attack Hits Russian Agencies with FoalShell and StallionRAT
Source: https://thehackernews.com/2025/10/new-cavalry-werewolf-attack-hits.html
Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs
Source: https://thehackernews.com/2025/10/ukraine-warns-of-cabinetrat-backdoor.html
A phishing campaign targeting Ukrainian government entities uses malicious SVG files to initiate an infection chain. The attack begins with emails containing SVG attachments that redirect victims to a download site. A CHM file is then used to execute a remote HTA loader, which delivers two malware payloads: Amatera Stealer and PureMiner. Amatera Stealer harvests extensive information from infected systems, including credentials, system data, application data, browser files, and cryptocurrency wallets. PureMiner collects hardware information and monitors system activity to deploy efficient CPU or GPU mining modules. The campaign demonstrates sophisticated techniques, including fileless malware delivery and the use of multiple stages to evade detection.
ESET researchers uncovered collaboration between two notorious APT groups, Gamaredon and Turla, both associated with Russia's FSB. The groups were observed working together to compromise high-profile targets in Ukraine. Evidence shows Gamaredon tools being used to restart and deploy Turla's Kazuar backdoor on specific machines. This cooperation indicates a strategic alignment between different FSB units, with Gamaredon likely providing initial access for Turla's more sophisticated operations. The collaboration was detected through multiple attack chains involving various malware tools from both groups. This discovery highlights the evolving tactics of Russian cyber espionage efforts, particularly in the context of the ongoing conflict in Ukraine.
A new malware loader named CountLoader has been identified, strongly associated with Russian ransomware gangs. It comes in three versions: .NET, PowerShell, and JScript. The threat is believed to be part of an Initial Access Broker's toolset or used by a ransomware affiliate linked to LockBit, BlackBasta, and Qilin groups. CountLoader was recently employed in a phishing campaign targeting Ukrainian citizens, impersonating the Ukrainian police. The loader attempts to connect to multiple C2 servers, downloads and executes various malware payloads, and uses advanced techniques to evade detection. It has been observed dropping CobaltStrike and AdaptixC2, among other malicious tools. The malware's functionality includes system information gathering, persistence mechanisms, and multiple download methods.
CopyCop, a Russian covert influence network, has significantly expanded its operations since March 2025, creating over 300 new fictional media websites targeting various countries. The network, likely operated by John Mark Dougan with support from Russian entities, aims to undermine support for Ukraine and exacerbate political fragmentation in Western countries. CopyCop's tactics include using deepfakes, AI-generated content, and impersonating media outlets to spread pro-Russian narratives. The network has widened its target languages and geographical scope, now including Turkey, Ukraine, Swahili-speaking regions, Moldova, Canada, and Armenia. While its core objectives remain unchanged, CopyCop has made marginal improvements to increase its reach, resilience, and credibility, including the use of self-hosted large language models for content generation.
The CyberVolk ransomware, emerging in May 2024, targets public institutions and key infrastructures of anti-Russian countries. It uses a double encryption structure with AES-256 GCM and ChaCha20-Poly1305 algorithms. The ransomware excludes certain files and directories from encryption and uses a symmetric key generated before the main function starts. A unique nonce is generated for each file encryption, but it's not stored, making decryption impossible. The ransomware includes a disguised decryption logic that fails due to an incorrect nonce value. This pro-Russian group communicates via Telegram and has claimed attacks on major facilities in Japan, France, and the UK.
Multiple Russia-linked influence operations are targeting Moldova's September 2025 parliamentary elections, aiming to destabilize the process and impede Moldova's EU accession. These operations, including Operation Overload, Operation Undercut, Foundation to Battle Injustice, and Portal Kombat, are projecting negative views of President Maia Sandu and the ruling Party of Action and Solidarity. They portray EU integration as disastrous for Moldova's economy and sovereignty, while suggesting closer ties with Russia as a favorable alternative. The operations employ various tactics, including inauthentic news content, social media manipulation, and automated content generation. While their impact on voter behavior appears limited so far, they pose risks to media integrity and public trust.
APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025, they conducted high-density intelligence theft activities against Ukrainian government agencies. The attack chain involves dynamic changes in infrastructure, abuse of Microsoft Dev Tunnels, and sophisticated data exfiltration techniques. The group employs white-listed domain camouflage, domain shadowing, and weaponization of cloud tunnel services to evade detection. Their data theft process includes registry-based persistence, multi-stage payload delivery via Cloudflare Workers, and exfiltration through legitimate cloud tools like Dropbox.
This analysis explores the infrastructure of Laundry Bear, a Russian state-sponsored APT group active since April 2024, targeting NATO countries and Ukraine. The investigation expands on initial indicators, using advanced pivoting techniques to uncover additional domains and infrastructure. Key findings include the discovery of multiple lookalike domains, similar registration patterns, and shared hosting infrastructure. The analysis reveals a network of domains with login and account management themes, redirecting to legitimate Microsoft services. The investigation also uncovers connections to other potential malicious activities, including spear-phishing attempts and the use of PDF files for possible malware delivery. The findings demonstrate the extensive infrastructure used by the threat actor and highlight the importance of advanced threat hunting techniques in uncovering related malicious activities.
LAMEHUG, discovered on July 10, 2025, is the first known malware integrating large language model capabilities into its attack methodology. Attributed to APT28 (Fancy Bear) with moderate confidence, it targeted Ukrainian government officials through phishing emails containing malicious executables. The malware uses the LLM Qwen2.5-Coder-32B-Instruct via Hugging Face's API to generate dynamic attack commands. Multiple variants were identified, with different data exfiltration methods. The attack appears to be a proof-of-concept exploration of LLM integration in state-sponsored cyber operations, demonstrating sophisticated reconnaissance capabilities through AI-generated commands. This development signals a new era of AI-incorporated malware operations, posing challenges for traditional cybersecurity approaches.
A Ukrainian Web3 team's interview process involved cloning a GitHub repository containing malicious components. Analysis revealed the project replaced a legitimate dependency with a malicious NPM package, rtk-logger@1.11.5. This package collected sensitive data, including cryptocurrency wallet information, from popular browsers and uploaded it to an attacker-controlled server. The malware also implemented keylogging, screen capture, and clipboard monitoring. Two other GitHub accounts were found using a similar malicious package. The scam aimed to trick interviewees into executing malicious code, potentially leading to data leaks and asset theft. Developers are advised to exercise caution when handling unknown GitHub projects and to use isolated environments for execution.
Bitdefender Labs has uncovered a new threat actor group named Curly COMrades, operating since mid-2024 to support Russian interests. The group targets critical organizations in countries experiencing geopolitical shifts, focusing on judicial and government bodies in Georgia and an energy distribution company in Moldova. Their primary objective is to maintain long-term network access and steal credentials. The attackers use proxy tools like Resocks, SSH, and Stunnel to establish multiple entry points, and deploy a new backdoor called MucorAgent. They also utilize compromised legitimate websites as traffic relays to complicate detection. The group's tactics include credential theft, lateral movement, and data exfiltration, employing both custom and open-source tools.
APT28, a Russian threat group, has developed LAMEHUG, a Python-based malware that utilizes AI to generate and execute system commands. This malware, targeting Ukraine's security and defense sector, begins with a phishing email containing a malicious attachment. LAMEHUG employs the Qwen 2.5-Coder-32B-Instruct model via Hugging Face API to translate text instructions into system commands. It performs system reconnaissance, data theft, and exfiltration using AI-generated commands. The malware collects system information, searches for documents, and exfiltrates data via SFTP or HTTP POST requests. Multiple variants of LAMEHUG have been identified, each with different data exfiltration methods. This marks a significant evolution in malware capabilities, incorporating large language models to enhance attack flexibility and sophistication.
