Gamaredon APT targets Ukrainian government agencies in new campaign

• Cisco Talos recently identified a new, ongoing campaign attributed to the Russia-linked Gamaredon APT that infects Ukrainian users with information-stealing malware.
• The adversary is using phishing documents containing lures related to the Russian invasion of Ukraine.
• LNK files, PowerShell and VBScript enable initial access, while malicious binaries are deployed in the post-infection phase.
• We discovered the use of a custom-made information stealer implant that can exfiltrate victim files of interest and deploy additional …

apt campaign gamaredon gamaredon apt government infostealer malware securex ukraine ukrainian