we help Ukrainian nonprofits with digital safety issues
Joined June 2018
- Tweets201
- Following70
- Followers336
- Likes196
Over the summer, Digital Security Lab Ukraine investigated a series of phishing campaigns targeting Ukrainian civil society organizations. Attackers sent fake event invitations and collaboration offers – including invitations to the Ukraine Recovery Conference 2026 – followed by malicious files disguised as legitimate documents.
After execution, the malicious files created Windows scheduled tasks used to download and execute malware and establish persistence on the system.
@Microsoft recently published a broader investigation, which also incorporated data from our research.
Microsoft named this technique RedFlick and linked the attacks to Star Blizzard (aka Coldriver/UNC4057), which is linked to Russia’s FSB.
Also, our colleagues at @RESIDENT_NGO documented similar campaigns targeting Moldovan media and civil society in September, with threat actors impersonating European donor organizations.
Researches:
🔗 dslua.org/publications/spear…
🔗 microsoft.com/en-us/security…
🔗 resident.ngo/lab/writeups/ma…
DSLU investigated a multi-stage phishing campaign targeting Ukrainian civil society that combines reply-baiting, malicious LNK files, GitHub+GitLab abuse, and fileless execution.
The attack starts with a harmless-looking collaboration email with no links or attachments. Only after the victim replies do the attackers send a link to an archive containing an LNK file disguised as a PDF.
Once opened, it displays a decoy document while executing malicious code in the background. The attackers use GitHub to deliver additional code, establish persistence through a scheduled task, and collect and exfiltrate data from the compromised system.
Full technical analysis and IOCs:
dslua.org/publications/livin…
1/3 🚨 DSLU investigated a targeted phishing campaign against the Ukrainian civic network OPORA.
Instead of stealing passwords, the attackers abused OAuth consent phishing to compromise Google accounts.
Technical analysis:
dslua.org/publications/phish…
1/3DSLU uncovered a targeted phishing campaign against Ukrainian civil society - advocacy groups, journalists, and economists.
The lure: fake #URC2026 Ukraine Recovery Conference invitations that quietly install Windows malware.
Full report: dslua.org/publications/spear…
🚨 DSLU analyzed a spearphishing campaign targeting Ukrainian organizations, attributed with moderate confidence to UAC-0050.
The attackers impersonate Ukraine’s State Tax Service and deliver LiteManager Pro RAT via password-protected archives hosted on Backblaze.
Threat actors are adapting @signalapp phishing campaigns: Ukrainian users now receive messages allegedly from Signal about “mandatory 2FA” due to ongoing attacks.
No codes are requested yet – this is a trust-building step before attempts to steal login codes and hijack accounts.
🔎 New analysis of a credential phishing campaign
It leverages domain-adaptive infrastructure to evade detection and increase the success rate of account compromise.
Details: dslua.org/publications/analy…
Large-scale phishing attacks keep evolving, abusing trusted platforms like Google, Cloudflare, Vercel, and Telegram. Pre-built kits enable massive scaling. A new “Meta Verified” tactic steals credentials and bypasses 2FA in real time via Telegram exfiltration.
Today we observed an active phishing campaign linked to Russia-aligned threat actors.
Emails impersonated Ukrainian government institutions and delivered malicious attachments. The campaign is aimed at infecting Windows endpoints and establishing persistent remote access.
