Offl Router virus causes Ukrainian users to upload confidential documents to Virus Total
Summary: Cisco Talos found over 100 documents uploaded to VirusTotal containing potentially confidential Ukrainian government and police information, infected with a multi-component VBA macro virus called OfflRouter that was created in 2015. The virus spreads only through shared documents and removable media, targets only .doc files, and its auto-start registry entry fails because it stores a folder path rather than the full executable path.
What you should know: Documents from Ukrainian local government and the National Police are landing in a public repository, and the Slovakian government CSIRT found infected documents already public on the Ukrainian National Police website in 2018 - a nearly decade-long leak that email-based controls would never have caught.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026