Tag: ukraine targeting

2 Attack Reports | 0 Vulnerabilities

Attack reports

Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open

Two Russia-aligned campaigns continue exploiting CVE-2025-8088, a WinRAR path traversal vulnerability patched in July 2025, against Ukrainian organizations through April 2026. SHADOW-EARTH-066 deploys an evolved GIFTEDCROOK information stealer using in-memory DLL loading via direct NT system calls,…
credential theft
information stealer
gammasteel
giftedcrook
CVE-2025-8088
ukraine targeting
winrar exploitation
2026-06-08
giftedcrook stealer
hta infection chain
russia-aligned threats
Published: June 8, 2026
Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218, CVE-2018-20250
Downloadable IOCs: 50

Obfuscation Without Effort: Breaking a GIFTEDCROOK Stealer

A fresh GIFTEDCROOK stealer variant was identified as part of a UAC-0226 campaign targeting Ukraine. Initial access leverages CVE-2025-6218 and CVE-2025-8088 through a weaponized RAR archive containing a decoy PDF themed around military registry information. The attack chain uses an LNK file to exe…
stealer
data exfiltration
rc4 encryption
giftedcrook
CVE-2025-8088
CVE-2025-6218
2026-04-13
phishing campaign
powershell payload
ukraine targeting
winrar exploitation
Published: April 13, 2026
Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218
Downloadable IOCs: 4
Click here to see more Attack Reports