SecuriTricks - russian targets

Dragons in Thunder

This report details the activities of two hacker groups, QuietCrabs and Thor, targeting Russian companies. QuietCrabs exploited RCE vulnerabilities in Microsoft SharePoint and Ivanti Endpoint Manager Mobile, using KrustyLoader and Sliver malware. Thor employed more common tools and techniques, atta…

lockbit

ivanti

Published: November 28, 2025

Linked vulnerabilities : CVE-2021-27065, CVE-2025-4428, CVE-2025-4427, CVE-2025-53770 (CVSS 9.8)

Downloadable IOCs: 75

The 'Bear' attacks: what we learned about the phishing campaign targeting Russian organizations

A hacking group named NetMedved has been conducting phishing attacks against Russian organizations since October 2025. The campaign uses malicious LNK files disguised as business documents to deliver NetSupport RAT malware. The attackers employ various techniques including PowerShell scripts, finge…

Published: November 26, 2025

Downloadable IOCs: 50

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

An unidentified spyware called Batavia has been targeting Russian industrial organizations since July 2024 through a sophisticated phishing operation. The campaign uses bait emails disguised as contract agreements to trick employees into downloading malicious scripts, initiating a multi-stage infec…

persistence mechanisms

russian targets

vbs scripts

delphi executable

Published: July 9, 2025

Downloadable IOCs: 2

Tag: russian targets

Attack reports

Dragons in Thunder

The 'Bear' attacks: what we learned about the phishing campaign targeting Russian organizations

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads