Russian GRU targets logistics and tech firms aiding Ukraine
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
GRU unit 26165 conducts espionage against Western logistics and IT companies supporting Ukraine aid delivery using credential theft and malware.
Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (unit 26165), tracked as APT28/Fancy Bear, has conducted a sustained cyber espionage campaign since 2022 targeting Western logistics entities and technology companies involved in coordinating and delivering aid to Ukraine. The campaign focuses on organizations in NATO member states and Ukraine across air, sea, and rail transportation, as well as IT services and defense industry. Operators seek access to sensitive shipping information including schedules, manifests, cargo contents, and routing details.
The campaign employs a mix of known techniques: credential guessing via Tor and VPNs, spearphishing with phishing-kit redirectors, and exploitation of public vulnerabilities including CVE-2023-23397 (Outlook NTLM), Roundcube flaws (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and CVE-2023-38831 (WinRAR). Post-compromise, operators establish persistence through mailbox permission abuse, scheduled tasks, and registry modifications; they exfiltrate data via EWS, IMAP, and SSH, often using infrastructure geographically proximate to victims to evade detection. The campaign is assessed to continue with similar TTPs. Multiple malware variants including HEADLACE and MASEPIE have been deployed. Separately, unit 26165 has targeted over 10,000 IP cameras via RTSP enumeration in Ukraine and border countries, likely to monitor aid shipment movement and military activity.
Mentioned in this report
Detection guidance
WinRAR Spawning Script Interpreter From Rar Temp Extraction Folder
WinRAR spawning cmd, PowerShell or script hosts that execute a file from its Rar$ temp extraction directory, a pattern seen with CVE-2023-38831 archive exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WinRAR Spawning Script Interpreter From Rar Temp Extraction Folder
description: Detects WinRAR spawning cmd, PowerShell or script hosts whose command
line references the Rar$ temporary extraction directory. This is the behaviour of
CVE-2023-38831 booby-trapped archives, where the user opens a decoy document and
a script runs from the extraction folder. Generalises on the parent/child relation
and temp-folder pattern, not on specific file names.
tags:
- attack.initial-access
- attack.execution
- attack.t1566
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WinRAR.exe
- \WinRAR32.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
CommandLine|contains: \Rar$
condition: selection
falsepositives:
- Users opening archives that contain legitimate batch or script files and running
them directly from WinRAR
- Software packages distributed as RAR archives with a script-based installer
level: high
id: 191a36af-db93-5658-9c72-d3539404c01b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
Mailbox or Mailbox Folder Permission Granted via PowerShell
PowerShell script block adding mailbox or mailbox-folder permissions with access rights, matching mailbox delegate abuse for persistence and email collection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mailbox or Mailbox Folder Permission Granted via PowerShell
description: Detects PowerShell script blocks that grant mailbox or mailbox-folder
permissions with Add-MailboxPermission, Add-MailboxFolderPermission or Set-MailboxFolderPermission
together with -AccessRights. Adversaries use this to persist and read mail through
delegate access. Review who ran it and which mailbox was affected.
tags:
- attack.persistence
- attack.collection
- attack.t1098.002
- attack.t1114.002
logsource:
category: ps_script
product: windows
detection:
selection_cmdlet:
ScriptBlockText|contains:
- Add-MailboxPermission
- Add-MailboxFolderPermission
- Set-MailboxFolderPermission
selection_rights:
ScriptBlockText|contains: AccessRights
condition: selection_cmdlet and selection_rights
falsepositives:
- Exchange administrators delegating shared mailbox or calendar access
- Onboarding or helpdesk automation scripts that grant delegate rights
level: medium
id: 780dabb8-a80c-5d17-ab92-367236171c8e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
Outbound SMB Connection to Public IP Address
Outbound TCP 445 connections to non-private addresses, consistent with forced NTLM authentication such as the CVE-2023-23397 Outlook reminder exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Outbound SMB Connection to Public IP Address
description: Detects initiated outbound connections on TCP port 445 to non-private,
non-loopback addresses. Forced-authentication attacks such as the CVE-2023-23397
Outlook reminder exploit make the victim host attempt NTLM authentication against
an attacker-controlled SMB server. Requires network_connection telemetry such as
Sysmon Event ID 3.
tags:
- attack.credential-access
- attack.t1187
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 445
filter_private:
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
- ::1/128
- fc00::/7
- fe80::/10
condition: selection and not filter_private
falsepositives:
- Cloud file shares reached over SMB across the internet, such as Azure Files
- Hosts using public IP addressing internally or VPN split-tunnel SMB access
level: medium
id: 56c669fd-956e-50d3-8446-4f04261d7b44
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
3 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs