Cybersecurity articles tagged #Ukraine on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukrainehttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukraineRussian state-sponsored group 'Laundry Bear' exploits a Zimbra zero-day via 'half-click' phishing, targeting US and Ukrainian entities for credential theft and backdoor…Fri, 24 Jul 2026 02:47:14 GMTLaundry BearZimbraZero-DayPhishingUSUkraineState Sponsoredhttps://runtimerebel.com/blog/russian-intelligence-hijacks-ip-cameras-to-track-nato-logisticshttps://runtimerebel.com/blog/russian-intelligence-hijacks-ip-cameras-to-track-nato-logisticsRussian intelligence services are hijacking security cameras to monitor military logistics and troop movements throughout NATO member states and Ukraine.Mon, 20 Jul 2026 14:11:56 GMTRussian IntelligenceIP CamerasNATOUkraineMilitary LogisticsAIVDMIVDhttps://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malwarehttps://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malwareRussian threat actor UAC-0145 uses deceptive ClickFix CAPTCHAs to deliver data-stealing malware to Ukrainian targets. Learn how to detect and mitigate these TTPs.Sun, 19 Jul 2026 16:59:50 GMTUAC 0145SandwormClickFixUkraineMalwarePhishinghttps://runtimerebel.com/blog/russian-intelligence-steals-messaging-credentials-via-sms-lureshttps://runtimerebel.com/blog/russian-intelligence-steals-messaging-credentials-via-sms-luresUkraine and the FBI expose a long-running Russian intelligence campaign using fake support messages to compromise officials' messaging accounts.Sat, 27 Jun 2026 20:29:25 GMTRussian IntelligenceSSUFBIPhishingMessaging SecurityUkrainehttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploithttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploitGoogle Threat Intelligence details STOCKSTAY, Turla's .NET backdoor for espionage targeting Ukraine and Europe, leveraging RDP & CVE-2025-8088.Fri, 26 Jun 2026 09:21:08 GMTTurlaSTOCKSTAYKAZUARAPTCyber EspionageUkraineGovernmentMilitaryCVE-2025-8088WinRARNET MalwareFSBhttps://runtimerebel.com/blog/russian-apt-gamaredon-upgrades-uac-0010-malware-arsenalhttps://runtimerebel.com/blog/russian-apt-gamaredon-upgrades-uac-0010-malware-arsenalAnalysis of Russian APT Gamaredon's (UAC-0010) upgraded arsenal, featuring stealthier Pterodo malware loading and volatile C2 infrastructure rotation.Fri, 26 Jun 2026 09:19:28 GMTGamaredonUAC 0010PterodoUkraineFSBhttps://runtimerebel.com/blog/turla-apt-deploys-stockstay-backdoor-in-ukraine-espionage-campaignhttps://runtimerebel.com/blog/turla-apt-deploys-stockstay-backdoor-in-ukraine-espionage-campaignRussian APT Turla targets Ukrainian government and military entities with the custom StockStay backdoor for persistent access and cyber espionage.Fri, 26 Jun 2026 09:18:02 GMTTurlaSTOCKSTAYUkraineEspionageRussian APTMalwarehttps://runtimerebel.com/blog/turla-deploys-new-stockstay-backdoor-in-ukraine-espionage-operationshttps://runtimerebel.com/blog/turla-deploys-new-stockstay-backdoor-in-ukraine-espionage-operationsGoogle identifies STOCKSTAY, a new .NET backdoor by Russian actor Turla targeting Ukrainian military and Italian foreign policy interests via Windows systems.Fri, 26 Jun 2026 09:17:20 GMTTurlaSTOCKSTAYUkraineEspionageTAG 70KRYPTONNEThttps://runtimerebel.com/blog/cve-2023-38831-russian-apts-target-ukraine-via-winrar-flawhttps://runtimerebel.com/blog/cve-2023-38831-russian-apts-target-ukraine-via-winrar-flawRussian threat actors are exploiting the CVE-2023-38831 WinRAR vulnerability to target Ukrainian government and military entities for data theft.Tue, 09 Jun 2026 17:01:57 GMTCVE-2023-38831WinRARAPT28SandwormUkrainehttps://runtimerebel.com/blog/cve-2025-8088-russia-aligned-groups-exploit-winrar-flaw-in-ukrainehttps://runtimerebel.com/blog/cve-2025-8088-russia-aligned-groups-exploit-winrar-flaw-in-ukraineRussia-linked actors Earth Dahu and UAC-0226 exploit the CVE-2025-8088 WinRAR path traversal flaw to deploy info-stealers against Ukrainian organizations.Tue, 09 Jun 2026 13:07:42 GMTCVE-2025-8088GamaredonWinRAREarth DahuUAC 0226Ukrainehttps://runtimerebel.com/blog/gamaredon-exploits-winrar-cve-2025-8088-to-target-ukrainehttps://runtimerebel.com/blog/gamaredon-exploits-winrar-cve-2025-8088-to-target-ukraineRussian threat actor Gamaredon weaponizes a WinRAR path traversal flaw to deploy GammaWorm and GammaSteel malware against Ukrainian entities.Tue, 02 Jun 2026 21:09:37 GMTGamaredonCVE-2025-8088WinRARUkraineGammaSteelGammaWormhttps://runtimerebel.com/blog/greyvibe-russian-actor-s-ai-powered-cyberattacks-target-ukrainehttps://runtimerebel.com/blog/greyvibe-russian-actor-s-ai-powered-cyberattacks-target-ukraineAnalysis of GREYVIBE, a newly discovered Russian-linked threat actor utilizing AI-powered techniques to target Ukrainian entities since August 2025.Fri, 29 May 2026 13:16:34 GMTGREYVIBEUkraineRussia LinkedAI Powered AttacksWithSecurehttps://runtimerebel.com/blog/greyvibe-actor-leverages-ai-lures-to-target-ukrainian-entitieshttps://runtimerebel.com/blog/greyvibe-actor-leverages-ai-lures-to-target-ukrainian-entitiesRussian threat cluster GreyVibe uses ChatGPT and Gemini to automate highly targeted phishing lures and deploy custom malware against Ukrainian targets.Fri, 29 May 2026 05:33:03 GMTGREYVIBEUAC 0149UkraineAI Driven AttacksSocial Engineeringhttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishinghttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishingBelarus-aligned Ghostwriter (UAC-0057) targets Ukrainian government entities with Prometheus-themed phishing emails to deploy sophisticated malware.Fri, 22 May 2026 20:37:28 GMTGhostwriterUAC 0057UNC1151UkraineGovernmentPhishingPrometheusCERT UAAPThttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishinghttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishingBelarussian APT 'FrostyNeighbor' is deploying spear-phishing campaigns against Polish and Ukrainian government entities after unique victim fingerprinting, aiming for…Thu, 14 May 2026 20:38:13 GMTFrostyNeighborAPTBelarusPolandUkraineEspionageSpear PhishingGovernmentNation Statehttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-with-geofenced-pdf-phishing-cobalt-strikehttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-with-geofenced-pdf-phishing-cobalt-strikeGhostwriter (UAC-0057) leverages geofenced PDF phishing to deliver Cobalt Strike against Ukrainian government entities, combining espionage and influence.Thu, 14 May 2026 16:45:40 GMTGhostwriterUAC 0057UkrainePhishingCobalt StrikeAPThttps://runtimerebel.com/blog/uac-0247-targets-ukrainian-healthcare-via-data-theft-malwarehttps://runtimerebel.com/blog/uac-0247-targets-ukrainian-healthcare-via-data-theft-malwareUAC-0247 is targeting Ukrainian clinics and government entities using malware designed to steal data from WhatsApp and Chromium-based browsers.Thu, 16 Apr 2026 08:40:22 GMTUAC 0247UkraineHealthcare SecurityInformation StealerData Thefthttps://runtimerebel.com/blog/agingfly-malware-credential-theft-operations-against-ukrainehttps://runtimerebel.com/blog/agingfly-malware-credential-theft-operations-against-ukraineAnalysis of AgingFly malware, a new threat observed actively targeting Ukrainian government and hospital entities to steal credentials from Chromium browsers and…Thu, 16 Apr 2026 00:47:01 GMTAgingFlyMalwareUkraineCredential TheftChromiumWhatsAppGovernmentHospitalshttps://runtimerebel.com/blog/apt28-targets-ukraine-and-nato-allies-with-new-prismex-malwarehttps://runtimerebel.com/blog/apt28-targets-ukraine-and-nato-allies-with-new-prismex-malwareAPT28 (Forest Blizzard) deploys the undocumented PRISMEX malware suite against Ukraine and NATO, utilizing COM hijacking and cloud-based C2 infrastructure.Wed, 08 Apr 2026 16:31:54 GMTAPT28PRISMEXForest BlizzardUkraineNATOCOM Hijackinghttps://runtimerebel.com/blog/apt28-targets-ukraine-via-cve-2024-45519-zimbra-exploithttps://runtimerebel.com/blog/apt28-targets-ukraine-via-cve-2024-45519-zimbra-exploitRussian APT28 hackers exploit CVE-2024-45519 in Zimbra Collaboration Suite to target Ukrainian government entities via malicious email-based command injection.Thu, 19 Mar 2026 16:25:10 GMTAPT28ZimbraCVE-2024-45519UkraineSSSCIPGRUhttps://runtimerebel.com/blog/darksword-iphone-exploit-kit-zero-day-attacks-on-ios-usershttps://runtimerebel.com/blog/darksword-iphone-exploit-kit-zero-day-attacks-on-ios-usersDarkSword, an advanced iPhone exploit kit, leverages multiple zero-day vulnerabilities to target users in Saudi Arabia, Turkey, Malaysia, and Ukraine for espionage and…Thu, 19 Mar 2026 00:37:39 GMTDarkSwordiOSiPhoneZero-DayExploit KitNation StateCybercrimeEspionageTurkeySaudi ArabiaMalaysiaUkraine