Over the summer, Digital Security Lab Ukraine investigated a series of phishing campaigns targeting Ukrainian civil society organizations. Attackers sent fake event invitations and collaboration offers – including invitations to the Ukraine Recovery Conference 2026 – followed by malicious files disguised as legitimate documents. After execution, the malicious files created Windows scheduled tasks used to download and execute malware and establish persistence on the system. @Microsoft recently published a broader investigation, which also incorporated data from our research. Microsoft named this technique RedFlick and linked the attacks to Star Blizzard (aka Coldriver/UNC4057), which is linked to Russia’s FSB. Also, our colleagues at @RESIDENT_NGO documented similar campaigns targeting Moldovan media and civil society in September, with threat actors impersonating European donor organizations. Researches: 🔗 dslua.org/publications/spear… 🔗 microsoft.com/en-us/security… 🔗 resident.ngo/lab/writeups/ma…

DSLU investigated a multi-stage phishing campaign targeting Ukrainian civil society that combines reply-baiting, malicious LNK files, GitHub+GitLab abuse, and fileless execution. The attack starts with a harmless-looking collaboration email with no links or attachments. Only after the victim replies do the attackers send a link to an archive containing an LNK file disguised as a PDF. Once opened, it displays a decoy document while executing malicious code in the background. The attackers use GitHub to deliver additional code, establish persistence through a scheduled task, and collect and exfiltrate data from the compromised system. Full technical analysis and IOCs: dslua.org/publications/livin…

Threat actors are adapting @signalapp phishing campaigns: Ukrainian users now receive messages allegedly from Signal about “mandatory 2FA” due to ongoing attacks. No codes are requested yet – this is a trust-building step before attempts to steal login codes and hijack accounts.