Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine

A previously unknown threat activity cluster impersonating Slovak cybersecurity company ESET has been observed phishing Ukrainian entities with trojanized ESET installers, delivering a backdoor called Kalambur (aka SUMBUR). The campaign was detected in May 2025 and is described as Russia-aligned, with spear-phishing emails and Signal messages containing a link to the trojanized installer.

According to ESET, the installer is designed to deliver the legitimate ESET AV Remover alongside Kalambur, which uses the Tor network for its command-and-control and is capable of dropping OpenSSH and enabling remote access via RDP on port 3389. The attackers have been active on domains such as esetsmart[.]com, esetscanner[.]com, and esetremover[.]com to host the installers, and CERT-UA has connected this activity to sub-clusters within Sandworm.

This campaign fits into broader Sandworm-related operations observed in Ukraine, including wiper and credential-theft activity, and appears to leverage brand trust to persuade targets to install malicious software.