Free, Unbiased, and Open threat intelligence
Free, Unbiased, and Open threat intelligence
threat Profile
Russian-linked attackers conducted multi-month intrusions against Ukrainian organizations, including a two-month campaign against a business services organization and a week-long attack against a local government entity. The attackers deployed the Localolive webshell (associated with Sandworm/Seashell Blizzard) to gain initial access by exploiting unpatched vulnerabilities on public-facing servers. They relied heavily on Living-off-the-Land tactics and dual-use tools to maintain persistent access, harvest credentials, perform memory dumps, establish remote access via RDP and OpenSSH, and exfiltrate sensitive information while maintaining a minimal footprint. The intrusions involved reconnaissance, credential harvesting through memory dumps targeting KeePass, registry manipulation, firewall modifications, and deployment of PowerShell backdoors and suspicious executables across multiple compromised systems.
Threat Actors
Malware
Published
7 months ago
Views
34