Russian Hackers Target Government with Stealthy “Living-Off-the-Land” Tactics

Russian-linked attackers have intensified their targeting of Ukrainian organisations using living-off-the-land tactics rather than heavy malware, according to GBHackers on Security. The two campaigns identified by the Threat Hunter Team included a two‑month breach of a large business services organisation and a week‑long attack against a local government entity, both aimed at harvesting sensitive data and establishing persistent access.

Initial access began with webshells on publicly facing servers, and the attackers used Localolive, a webshell that Microsoft associates with Seashell Blizzard, a sub‑group of Sandworm; according to Microsoft, this group is a unit of Russia’s GRU. Following access from 27 June 2025, they conducted system reconnaissance with whoami, tasklist and systeminfo, while disabling Windows Defender protections in the Downloads folder to enable tool deployment.

They established persistence via scheduled tasks running every 30 minutes to extract credentials, and later deployed OpenSSH, opened firewall rules on port 22 and pre‑authentication‑less RDP to create multiple remote access vectors; they also conducted credential harvesting from memory and registry hives.

The activity continued across at least four compromised machines into mid‑August, with the final traces on 20 August 2025, and included use of legitimate utilities like the Windows Resource Leak Diagnostic tool and KeePass process targeting.