One mighty fine-looking report
Summary: Cisco Talos is tracking an ongoing campaign targeting users in Ukraine with malicious LNK files, compressed inside ZIP archives and disguised as Office documents, that run a PowerShell downloader. Talos assesses with medium confidence that the activity is associated with the Gamaredon threat actor group, which has used the invasion of Ukraine as a common phishing theme.
Why it matters: Gamaredon continues to lure Ukrainian users with file names tied to troop movements, so defenders in the region face a persistent actor recycling the same technique rather than a one-off campaign.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026