Russian hackers, likely linked to Sandworm, exploit legitimate tools against Ukrainian targets

Russian hackers, likely linked to Sandworm, targeted Ukrainian organisations by using living-off-the-land techniques and dual-use tools to harvest data and stay hidden, according to Symantec Threat Hunter Team and Carbon Black. The report notes intrusions into a major business services firm for two months and a local government for a week, with attackers relying on legitimate software and minimal malware to minimise their footprint.

Localised activity included deployment of web shells, credential dumping, and persistence mechanisms, while attackers used unpatched vulnerabilities to plant web shells such as Localolive and to enable remote access. The article also states that while the researchers have not independently confirmed a link to Sandworm, the attacks appear to be Russian in origin, with Sandworm historically associated with the Russian GRU. The findings emphasise how the group has leveraged dual-use tools to steal data and maintain long-term access in Ukrainian networks.