Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv

Ukrainian Cops Spoofed in Fileless Phishing Attacks on Kyiv reports that attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner, targeting Microsoft Windows machines at government entities in Ukraine. The phishing emails carry malicious Scalable Vector Graphics files designed to entice recipients to open attachments, with the SVG named "elektronni_zapit_NPU.svg" containing an embedded HTML iframe and a spoofed Adobe Reader interface.

If opened, victims are redirected to a password‑protected archive that reveals a CHM file, triggering a fileless infection chain that uses HTML Application (HTA) CountLoader. The two payloads harvested credentials and data while also mining cryptocurrency, with Amatera collecting browser and system data and PureMiner deploying CPU or GPU mining modules depending on configuration.

Fortiguard Labs Threat Research revealed the campaign, noting the SVG can act as an HTML substitute to initiate infection and that the attackers rely on memory‑resident execution, either through .NET Ahead‑of‑Time compilation with process hollowing or by loading into memory via PythonMemoryModule. This campaign is part of ongoing cyber activity against Ukraine since the 2022 invasion, and Fortiguard Labs rated it high severity.