Malicious campaigns target government, military and civilian entities in Ukraine, Poland
Summary: Cisco Talos discovered a campaign in late April using malicious Excel and PowerPoint files with Ukrainian and Polish government and military lures to trick users into enabling macros, and later uncovered additional campaigns including two previously reported by Ukraine's CERT-UA and FortiGuard Labs. A new campaign on July 4, 2023 used a payment instruction form appearing to come from the State Treasury Service of Ukraine, and the July 2023 final payload was njRAT, an open-source remote access trojan used by both commodity actors and APTs.
What's compelling: The actor behind these lures is targeting Ukrainian and Polish government and military organizations, and the use of freely available njRAT makes attribution of the attacks more difficult.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026