Pro-Russian Hackers Target Critical Industries Across the Globe

According to GBHackers, pro-Russian hacking groups have intensified campaigns against critical industries worldwide as Russia leverages cyber operations to offset sanctions and bolster war capabilities. The report highlights SectorJ149 (also known as UAC-0050) as a notable actor, which in 2024 carried out indiscriminate DDoS attacks on public institutions and conducted precision intrusions into private enterprises.

In South Korea, spear-phishing emails circulated in November targeting executives and staff in manufacturing, energy and semiconductor sectors with counterfeit purchase orders and attached compressed files, while Ukraine saw similar malware loaders and network indicators affecting insurance and retail companies.

The attack chain typically involves four stages—initial access, execution, persistence and defence evasion—with tailored spear-phishing using obfuscated Visual Basic Script, a Base64 payload loaded as a PE file in memory, and in-memory loading that avoids disk-based detection. Final-stage malware such as Lumma Stealer, FormBook, Remcos RAT, Tektonit RMS, Medusa Stealer, Xeno RAT and Mars Stealer focus on information theft, including cryptocurrency seeds, private keys and credential data.

As tensions rise, the piece notes that pro-Russian actors are redirecting resources toward high-impact, global campaigns and advocates enhanced phishing defences and threat intelligence sharing.