Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics
Summary: Symantec and Carbon Black reported that Russian-origin threat actors targeted a large Ukrainian business services organization for two months and a local government entity for a week, gaining access by deploying web shells on public-facing servers, most likely through unpatched vulnerabilities. The attackers used living-off-the-land tactics and dual-use tools with minimal malware, including the Localolive web shell, PowerShell commands to exclude Downloads from Microsoft Defender scans, and a scheduled task that performed a memory dump every 30 minutes, with early activity dating to June 27, 2025.
Bottom line: The intrusion relied on legitimate Windows tools and dual-use software rather than malware, so signature-based detection had little to catch while credentials were stolen over two months. Symantec and Carbon Black said they found no evidence linking the activity to Sandworm, only that it appeared Russian in origin.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-8088
- Related