# Russian GRU targets logistics and tech firms aiding Ukraine Published: 2026-04-17 · Severity: high · Sectors: defense, transportation, technology, government-national Canonical: https://vorant.io/reports/631f4e74-4284-5c4b-ab29-af69f0f03e20/russian-gru-targets-logistics-and-tech-firms-aiding-ukraine > GRU unit 26165 conducts espionage against Western logistics and IT companies supporting Ukraine aid delivery using credential theft and malware. Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (unit 26165), tracked as APT28/Fancy Bear, has conducted a sustained cyber espionage campaign since 2022 targeting Western logistics entities and technology companies involved in coordinating and delivering aid to Ukraine. The campaign focuses on organizations in NATO member states and Ukraine across air, sea, and rail transportation, as well as IT services and defense industry. Operators seek access to sensitive shipping information including schedules, manifests, cargo contents, and routing details. The campaign employs a mix of known techniques: credential guessing via Tor and VPNs, spearphishing with phishing-kit redirectors, and exploitation of public vulnerabilities including CVE-2023-23397 (Outlook NTLM), Roundcube flaws (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026), and CVE-2023-38831 (WinRAR). Post-compromise, operators establish persistence through mailbox permission abuse, scheduled tasks, and registry modifications; they exfiltrate data via EWS, IMAP, and SSH, often using infrastructure geographically proximate to victims to evade detection. The campaign is assessed to continue with similar TTPs. Multiple malware variants including HEADLACE and MASEPIE have been deployed. Separately, unit 26165 has targeted over 10,000 IP cameras via RTSP enumeration in Ukraine and border countries, likely to monitor aid shipment movement and military activity. ## Mentioned in this report - Vulnerabilities: CVE-2020-12641 (KEV), CVE-2020-35730 (KEV), CVE-2021-44026 (KEV), CVE-2023-23397 (KEV), CVE-2023-38831 (KEV) - Threat actors: GRU 85th Main Special Service Center - Malware: Headlace, MASEPIE ## Detection guidance (public sample) ### WinRAR Spawning Script Interpreter From Rar Temp Extraction Folder ATT&CK: T1566 WinRAR spawning cmd, PowerShell or script hosts that execute a file from its Rar$ temp extraction directory, a pattern seen with CVE-2023-38831 archive exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: WinRAR Spawning Script Interpreter From Rar Temp Extraction Folder description: Detects WinRAR spawning cmd, PowerShell or script hosts whose command line references the Rar$ temporary extraction directory. This is the behaviour of CVE-2023-38831 booby-trapped archives, where the user opens a decoy document and a script runs from the extraction folder. Generalises on the parent/child relation and temp-folder pattern, not on specific file names. tags: - attack.initial-access - attack.execution - attack.t1566 - attack.t1204.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \WinRAR.exe - \WinRAR32.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \mshta.exe CommandLine|contains: \Rar$ condition: selection falsepositives: - Users opening archives that contain legitimate batch or script files and running them directly from WinRAR - Software packages distributed as RAR archives with a script-based installer level: high id: 191a36af-db93-5658-9c72-d3539404c01b status: experimental author: Vorant references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a ``` ### Mailbox or Mailbox Folder Permission Granted via PowerShell ATT&CK: T1098.002 PowerShell script block adding mailbox or mailbox-folder permissions with access rights, matching mailbox delegate abuse for persistence and email collection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Mailbox or Mailbox Folder Permission Granted via PowerShell description: Detects PowerShell script blocks that grant mailbox or mailbox-folder permissions with Add-MailboxPermission, Add-MailboxFolderPermission or Set-MailboxFolderPermission together with -AccessRights. Adversaries use this to persist and read mail through delegate access. Review who ran it and which mailbox was affected. tags: - attack.persistence - attack.collection - attack.t1098.002 - attack.t1114.002 logsource: category: ps_script product: windows detection: selection_cmdlet: ScriptBlockText|contains: - Add-MailboxPermission - Add-MailboxFolderPermission - Set-MailboxFolderPermission selection_rights: ScriptBlockText|contains: AccessRights condition: selection_cmdlet and selection_rights falsepositives: - Exchange administrators delegating shared mailbox or calendar access - Onboarding or helpdesk automation scripts that grant delegate rights level: medium id: 780dabb8-a80c-5d17-ab92-367236171c8e status: experimental author: Vorant references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a ``` ### Outbound SMB Connection to Public IP Address ATT&CK: T1187 Outbound TCP 445 connections to non-private addresses, consistent with forced NTLM authentication such as the CVE-2023-23397 Outlook reminder exploit. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Outbound SMB Connection to Public IP Address description: Detects initiated outbound connections on TCP port 445 to non-private, non-loopback addresses. Forced-authentication attacks such as the CVE-2023-23397 Outlook reminder exploit make the victim host attempt NTLM authentication against an attacker-controlled SMB server. Requires network_connection telemetry such as Sysmon Event ID 3. tags: - attack.credential-access - attack.t1187 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationPort: 445 filter_private: DestinationIp|cidr: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 127.0.0.0/8 - 169.254.0.0/16 - ::1/128 - fc00::/7 - fe80::/10 condition: selection and not filter_private falsepositives: - Cloud file shares reached over SMB across the internet, such as Azure Files - Hosts using public IP addressing internally or VPN split-tunnel SMB access level: medium id: 56c669fd-956e-50d3-8446-4f04261d7b44 status: experimental author: Vorant references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. 3 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free. Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/631f4e74-4284-5c4b-ab29-af69f0f03e20/russian-gru-targets-logistics-and-tech-firms-aiding-ukraine. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup