Russia-aligned actor UAC-0099 targeted Ukrainian government personnel using malware (ASHVEIN) that steals credentials and enables remote control. A key lure described is a malicious .NET file that shows a decoy Microsoft Word document pretending to be an official response from Ukraine’s National Police, encouraging recipients to trust and open it while malware installs in the background.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this email: subject line says “Official response from the National Police of Ukraine,” attachment called AnswerFromPolice. You open it, a Word document pops up that looks like a real police reply. But AnswerFromPolice is actually a .NET app dropping ASHVEIN malware while you read. ASHVEIN can grab Chrome and Firefox passwords, take screenshots, collect files, and let someone remotely run commands on your machine, all triggered by that one ‘official’ attachment. If you get an unexpected ‘official’ police or government document, stop. Don’t open it, call or email your known contact to verify it first.
U.S. prosecutors say a Russian national used hundreds of fake accounts on a freelance platform to send Excel files that tricked users into enabling macros, which then downloaded remote-control malware. The campaign targeted tens of thousands of users and led to thousands of infections, enabling…
Researchers say the North Korea-linked Lazarus group ran “Operation Dream Job,” posing as recruiters and sending fake job offers to lure targets into downloading trojanized PDF tools and opening booby-trapped PDFs. The campaign focused largely on defense-related organizations and used both a…
Researchers linked an Iran-aligned campaign to recruitment-themed social engineering that tricked a targeted Iraqi software engineer into downloading a fake "Dubai Airports" careers portal and then opening a trojanized Visual Studio coding test. The lure abused normal developer workflows so malware…
Researchers observed a real phishing campaign (“CSuite”) heavily targeting U.S. organizations using familiar business-themed lures (DocuSign, Adobe, Zoom/Meet, Dropbox, Microsoft 365). After a victim engages, the attackers either steal Microsoft 365 sessions (enabling mailbox takeover and fraud) or…
Check Point says North Korea’s Lazarus Group targeted defense and aerospace professionals using convincing fake job offers that led victims to download trojanized PDF software. The campaign used a Windows zero-day (now patched as CVE-2026-68820) to gain full control and hide from security tools,…
Researchers describe a real, ongoing Lazarus-linked campaign where targets are lured with attractive job offers and tricked into downloading a PDF viewer and “job description” documents. Opening the files installs backdoors and, in at least one wave, attackers used a Windows zero-day to gain deep…
