Ukrainian organizations have been subjected to escalated intrusions from Russia-linked threat actors, according to The Hacker News.
Newly emergent InedibleOchotense threat operation, which is associated with Sandworm's BACKORDER-related campaign, has delivered spear-phishing emails and text messages under the guise of ESET to spread a weaponized AV Remover installer that included the Kalambur backdoor, also known as SUMBUR, a report from ESET showed.
Kalambur not only allowed Remote Desktop Protocol-based remote access but also OpenSSH deployment. Meanwhile, Sandworm itself targeted an unnamed Ukrainian university with the ZEROLOT and Sting wiper malware before attacking the country's energy, government, grain, and logistics sectors. All of the impacted organizations were noted to be initially infiltrated by the UAC-0099 hacking operation.
Such increased activity from Sandworm also coincides with mounting attacks from the RomCom hacking group, which had exploited a WinRAR flaw to launch the RustyClaw and SnipBot payloads, as well as a Mythic agent.
