Russian Hackers Target Ukrainian Organizations Using Stealthy Living-Off-the-Land Tactics

According to Symantec and Carbon Black Threat Hunter Team, Russian-origin threat actors targeted Ukrainian organisations, including a large business services company for two months and a local government entity for a week, using stealthy living-off-the-land techniques to siphon data and maintain access.

The operation relied on dual-use tools and minimal malware to stay under the radar, with attackers gaining initial access by deploying web shells on public-facing servers—most likely via unpatched vulnerabilities—and using Localolive to deliver next-stage payloads such as Chisel, plink, and rsockstun.

Early signs of activity were detected from 27 June 2025, when footholds were used to drop a web shell and conduct reconnaissance, followed by PowerShell commands to exclude Downloads from Defender scans and a memory-dump schedule every 30 minutes. Over the ensuing weeks, actions included dropping more web shells, enumerating files, targeting KeePass vaults, enabling remote access via RDP and OpenSSH, and deploying a domain account-backed backdoor with a 30-minute schedule.

The report notes the attacks were Russian in origin and characterised by legitimate tools rather than heavy malware, while mentioning Gamaredon’s exploitation of CVE-2025-8088 as a related thread in Ukraine-targeted campaigns.