Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics

"The activity, according to a new report from the Symantec and Carbon Black Threat Hunter Team, targeted a large business services organization for two months and a local government entity in the country for a week. The attacks mainly leveraged living-off-the-land (LotL) tactics and dual-use tools, coupled with minimal malware, to reduce digital footprints and stay undetected for extended periods of time."

"One of the web shells used in the attack was Localolive, which was previously flagged by Microsoft as put to use by a sub-group of the Russia-linked Sandworm crew as part of a multi-year campaign codenamed BadPilot. LocalOlive is designed to facilitate the delivery of next-stage payloads like Chisel, plink, and rsockstun. It has been utilized since at least late 2021."

"Early signs of malicious activity targeting the business services organization date back to June 27, 2025, with the attackers leveraging the foothold to drop a web shell and use it to conduct reconnaissance. The threat actors have also been found to run PowerShell commands to exclude the machine's Downloads from Microsoft Defender Antivirus scans, as well as set up a scheduled task to perform a memory dump every 30 minutes."

Threat actors of Russian origin targeted organizations in Ukraine to siphon sensitive data and maintain persistent access to compromised networks. Attacks hit a large business services organization for two months and a local government entity for a week. Adversaries relied on living-off-the-land tactics and dual-use tools with minimal malware to minimize detection. Initial access to the business services organization was gained by deploying web shells on public-facing servers, likely via unpatched vulnerabilities. One web shell identified was LocalOlive, used to deliver next-stage payloads such as Chisel, plink, and rsockstun. Compromises included PowerShell commands to exclude Defender scans, scheduled memory dumps, registry hive exfiltration, and file enumeration.

Read at The Hacker News