All news with #russia nexus tag

🕵️ ESET researchers report that Russian state-linked groups Gamaredon and Turla collaborated in 2025 campaigns targeting high-value Ukrainian defense systems. In February, investigators observed Turla issuing commands via Gamaredon implants and Gamaredon's PteroGraphin downloader being used to restart Turla's Kazuar backdoor. Kazuar harvested machine metadata while Gamaredon later deployed Kazuar v2 installers in April and June. ESET assesses with high confidence that the interactions reflect a deliberate operational convergence.

🚨 ESET Research reports the first observed collaboration between Gamaredon and Turla in Ukraine, with telemetry from February to June 2025 showing Gamaredon tools used to deliver and restart Turla’s Kazuar implants. ESET assesses with high confidence that Gamaredon provided initial access and delivery channels while Turla selectively deployed advanced Kazuar implants on higher‑value hosts. The analysis details multiple infection chains involving PteroGraphin, PteroOdd and PteroPaste, and includes technical indicators and remediation guidance.

🔒ESET researchers observed tools from Russian-linked groups Gamaredon and Turla cooperating to deploy the .NET-based Kazuar backdoor on multiple Ukrainian endpoints in early 2025. Gamaredon delivered PowerShell downloaders — PteroGraphin, PteroOdd and PteroPaste — which retrieved Kazuar payloads via Telegraph, Cloudflare Workers domains and direct IP hosting. Analysts assess with high confidence that Gamaredon provided initial access while Turla leveraged the access for espionage, primarily targeting Ukrainian defense-sector assets.

🔍 A representative Bitkom survey of 1,002 German companies finds nearly three in four report rising attacks, estimating combined damage at €289 billion. 87% of executives said their organization experienced at least one attack in the past 12 months; 28% now suspect foreign intelligence involvement. Respondents most often pointed to China and Russia (46% each). Insurers report AI-generated false claims, prompting firms and authorities to adopt more holistic, AI-assisted defenses.

🔒 Researchers have identified CountLoader, a multi‑language malware loader used by Russian ransomware affiliates and initial access brokers to deploy post‑exploit tools such as Cobalt Strike, AdaptixC2 and the commercial PureHVNC RAT. Appearing in .NET, PowerShell and JavaScript flavors, the loader has been observed in PDF phishing campaigns targeting Ukraine and employs LOLBins and multiple download/execution methods to evade detection. The JavaScript variant is most feature‑complete, offering diverse downloaders, execution paths and persistence via a Google‑update‑named scheduled task.

🔁 In May 2025 the EU sanctioned Moldova-based PQ Hosting and its owners, the Neculiti brothers, for alleged links to Kremlin hybrid warfare. Recorded Future and KrebsOnSecurity reporting show Stark Industries quickly rebranded to the[.]hosting under Dutch WorkTitans BV on 24 June 2025 while key address space and assets moved to PQ Hosting Plus S.R.L. Netherlands-based MIRhosting appears to host and manage the new entities, suggesting the sanctions achieved little lasting disruption.

🚨 Operation BarrelFire, attributed to a group Seqrite Labs calls Noisy Bear, targeted Kazakhstan's national oil company KazMunaiGas in May 2025 using tailored phishing. Attackers sent ZIP attachments containing an .LNK downloader, a decoy document, and a README in Russian and Kazakh instructing use of a fake KazMunayGaz_Viewer. The chain deployed a malicious batch, a PowerShell loader named DOWNSHELL, and a 64-bit DLL implant that executes shellcode to open a reverse shell. Infrastructure was linked to Russia-based bulletproof host Aeza Group, which has been sanctioned.

🛡️ The U.S. Department of State is offering up to $10 million for information on three Russian FSB officers accused of carrying out cyberattacks against U.S. critical infrastructure. The named individuals — Marat Valeryevich Tyukov, Mikhail Mikhailovich Gavrilov, and Pavel Aleksandrovich Akulov — are tied to the FSB's Center 16, tracked under aliases such as Berserk Bear and Dragonfly. Charged in March 2022, the officers are alleged to have run intrusions from 2012–2017 targeting government agencies and energy firms, and recent activity shows exploitation of CVE-2018-0171 in end-of-life Cisco devices. The State Department directs tips to its Rewards for Justice Tor channel; eligible informants could receive rewards and relocation assistance.

🔒 Amazon's threat intelligence team identified and disrupted a watering hole campaign conducted by APT29, a group linked to Russia’s SVR. The actor compromised legitimate websites and injected obfuscated JavaScript to redirect a subset of visitors to attacker-controlled pages that mimicked Cloudflare verification. The campaign aimed to abuse Microsoft's device code authentication flow to trick users into authorizing attacker-controlled devices; Amazon isolated affected EC2 instances and coordinated with partners to disrupt infrastructure and share intelligence.

🔒 Cisco Talos identifies the threat cluster Static Tundra as a long-running, Russian state-sponsored actor that compromises unpatched and end-of-life Cisco networking devices to support espionage operations. The group aggressively exploits CVE-2018-0171 and leverages weak SNMP community strings to enable local TFTP retrieval of startup and running configurations, often exposing credentials and monitoring data. Talos also observed persistent firmware implants, notably SYNful Knock, and recommends immediate patching or disabling Smart Install, strengthening authentication, and implementing configuration auditing and network monitoring to detect exfiltration and implanted code.

🔒 ESET researchers uncovered a previously unknown WinRAR vulnerability, tracked as CVE-2025-8088, that is being actively exploited by the Russia-aligned actor RomCom in targeted spearphishing campaigns. The Windows path traversal flaw enables execution of arbitrary code when victims open crafted archives. Users should update to WinRAR 7.13 immediately and consult ESET's video and blogpost for indicators and mitigation.

🔒 ESET researchers disclosed a previously unknown WinRAR zero-day, CVE-2025-8088, actively exploited by the Russia-aligned group RomCom. The flaw is a path-traversal vulnerability that leverages NTFS alternate data streams (ADS) to conceal malicious files in RAR archives, which are silently deployed on extraction. Observed payloads included a Mythic agent, a SnipBot variant, and RustyClaw (MeltingClaw), targeting organizations in finance, manufacturing, defense and logistics. Users and vendors relying on WinRAR, UnRAR.dll or its source must update to the July 30, 2025 patched release immediately.

🔍 The latest ESET APT Activity report and podcast episode summarize intrusion activity observed across Q4 2024–Q1 2025, highlighting persistent and evolving adversary techniques. ESET researchers spotlight China-aligned actors such as UnsolicitedBooker, which repeatedly targeted the same organization with the MarsSnake backdoor, and tool-sharing trends centered on groups like Worok. The report also covers Russia-aligned operations — Sednit’s expanded Operation RoundPress against webmail platforms, ongoing Gamaredon obfuscation in Ukraine, and Sandworm’s use of the ZEROLOT wiper — plus activity from other regional actors that complicate attribution and detection.