Russian APTs Exploit LotL Techniques in Ukraine Cyber Attacks, Deploying Sandworm-Linked Webshell and Credential Dumping

The Symantec Threat Hunter Team uncovered two major cyber intrusions in Ukraine attributed to Russian-aligned threat actors, conducted between late June and August 2025 with aims of data theft and persistence across business and government networks. The operation relied on Living-off-the-Land techniques, abusing legitimate Windows utilities and administrative tools to blend malicious activity into normal network behaviour, with minimal malware deployment.

Attackers initially gained access by deploying webshells on public-facing servers, one being Localolive, which is linked to a sub-group of Sandworm (Seashell Blizzard), a unit of Russia’s GRU, though attribution remains a matter of interpretation; the attackers were described as Russian in origin by the report.

Symantec notes that the intruders used LotL commands and scripts to maintain access, gather intelligence and exfiltrate credentials, including running recon commands such as whoami, systeminfo and net group /domain via cmd.exe and PowerShell. They created scheduled tasks to perform memory dumps every 30 minutes using comsvcs.dll to harvest credential data, and later used PowerShell backdoors and tools like rdrleakdiag to collect full memory dumps.

The operation also involved attempts to identify KeePass processes and to dump Windows registry hives while expanding across multiple systems to sustain footholds with a minimal footprint. According to the report, the attackers demonstrated deep knowledge of Windows native tools and left room for continued Russian cyber espionage against Ukrainian institutions.