Russia-linked APT InedibleOchotense impersonates ESET to deploy backdoor on Ukrainian systems

Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks on Ukrainian targets detected in May 2025. The campaign employed emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor, with links to fake ESET domains such as esetsmart[.]com, esetscanner[.]com and esetremover[.]com hosting the malicious ZIP file.

The backdoor campaign shares tactics with activity previously attributed to UAC-0212 and the BACKORDER downloader, and researchers noted minor language errors suggesting translation from Russian to Ukrainian. According to a report published by ESET, the phishing email impersonated ESET and warned users of suspicious activity, urging them to download “official threat removal software.” The attackers leveraged ESET’s strong Ukrainian reputation to mislead victims into installing malware.