# APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)

> APT28 (Fancy Bear / UAC-0001 / Forest Blizzard / BlueDelta / GRU Unit 26165) has executed a sustained, multi-vector cyber espionage campaign against Ukraine and EU member states throughout 2024-2026, deploying at least 6 distinct malware families, exploiting zero-day vulnerabilities, pioneering the first known LLM-powered malware (LAMEHUG), targeting western logistics and defense supply chains via a 21-nation joint advisory, compromising webmail servers across 4 platforms (Roundcube, Horde, MDaemon, Zimbra) via Operation RoundPress, and weaponizing Signal Desktop as a spearphishing vector in Operation Phantom Net Voxel. Key innovations: (1) LAMEHUG uses Qwen2.5-Coder-32B-Instruct via Hugging Face API for real-time command generation — the first documented state-sponsored LLM integration in malware; (2) Signal Desktop exploitation bypasses MOTW (Mark of the Web) protections because Signal does not apply MOTW to received files, allowing VBA macros to execute without Microsoft Office security blocks; (3) SpyPress.MDAEMON exploited a zero-day XSS (CVE-2024-11182) to bypass 2FA in webmail; (4) BEARDSHELL uses IceDrive cloud storage for C2, GONEPOSTAL provides Outlook backdoor access, and Covenant/Grunt framework leverages Koofr cloud API for staging — all using legitimate cloud services to evade detection. The campaign demonstrates GRU's systematic targeting of Ukraine's security/defense sector, EU logistics networks supporting Ukraine aid, and NATO defense companies — with Ukraine serving as a live testing ground for capabilities later deployed against Western targets.

- **Published:** 2026-02-12T05:05:38Z
- **Last reviewed:** 2026-02-12T05:05:38Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0066
- **ID:** TL-2026-0066
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-11182, CVE-2023-43770, CVE-2024-27443, CVE-2023-23397, CVE-2023-38831, CVE-2020-35730, CVE-2020-12641, CVE-2021-44026

## Description

APT28/UAC-0001 Sustained Cyber Espionage Campaign Against Ukraine and EU (2024-2026 New TTPs)

Attribution: GRU 85th Main Special Service Center (GTsSS), Military Unit 26165. Tracked as APT28, Fancy Bear, Forest Blizzard, BlueDelta, Sednit, Sofacy, Pawn Storm, STRONTIUM, ITG05, UAC-0001, UAC-0028, and 20+ other aliases.

This threat consolidates the significant escalation in APT28's capabilities and targeting during the 2024-2026 period, focusing on newly documented TTPs that represent evolution beyond previously tracked activity (see TL-2026-0052 for earlier APT28 operations).

=== CAMPAIGN 1: OPERATION PHANTOM NET VOXEL (Sekoia, Sep 2025) ===

Infection Vector: Signal Desktop spearphishing — a first for APT28. Signal Desktop does NOT implement Mark of the Web (MOTW), meaning files received via Signal do not get tagged with the ADS zone identifier. This allows VBA macros in received Office documents to execute without Microsoft Office's MOTW-based security blocks (which would normally prevent macro execution for internet-downloaded files).

Social Engineering: Messages sent via private Signal chats, impersonating colleagues/superiors, invoking compensation decisions and threatening legal action to create urgency. Targets: Ukrainian military administrative staff — brigade-level HR, logistics, command structures.

Lure Documents: Ukrainian military administrative forms — personnel evaluations, medical compensation requests, drone delivery receipts, military permission forms. At least 11 weaponized Office documents identified. Documents designed to appear credible to on-the-ground military personnel under martial law.

Infection Chain:
1. VBA macros in Office document execute on open (no MOTW block via Signal)
2. Macros verify Windows OS and .NET Framework v4.0.30319
3. COM hijack persistence: registers malicious prnfldr.dll at HKCU\Software\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\InProcServer32 — the Printers CLSID, loaded by explorer.exe at every logon
4. Steganography: windows.png (valid Windows background image) contains AES-CBC encrypted shellcode hidden in LSB of each pixel's RGBA values (4 bytes per pixel, LSB extraction)
5. Shellcode loads .NET Covenant/Grunt framework — GruntHTTPStager establishes API-driven channel to Koofr cloud storage
6. Downloads PlaySndSrv.dll + sample-03.wav → extracts BEARDSHELL C++ backdoor
7. BEARDSHELL uses IceDrive cloud storage for C2 — receives and executes PowerShell commands
8. SlimAgent spyware also observed on same compromised servers

Key Innovation: Signal Desktop MOTW bypass is the critical enabler. Microsoft's macro blocking policies (implemented 2022) are completely circumvented because Signal doesn't mark received files as internet-sourced.

=== CAMPAIGN 2: LAMEHUG — First LLM-Powered Malware (CERT-UA, Jul 2025) ===

Discovery: July 10, 2025, by CERT-UA. Published July 17, 2025. Attribution: APT28 with moderate confidence.

Target: Ukrainian government officials.

Attack Vector: Phishing emails impersonating Ukrainian ministry officials, containing ZIP archives with PyInstaller-compiled Python executables (.pif extension).

LLM Integration: LAMEHUG uses Qwen2.5-Coder-32B-Instruct model via Hugging Face API (approximately 270 tokens for authentication) to generate commands in real-time:

Prompt 1 (System Reconnaissance): 'Make a list of commands to create folder C:\Programdata\info and to gather computer information, hardware information, process and services information, networks information, AD domain information, to execute in one line and add each result to text file c:\Programdata\info\info.txt. Return only commands, without markdown.'

Prompt 2 (Document Harvesting): 'Make a list of commands to copy recursively different office and pdf/txt documents in user Documents, Downloads and Desktop folders to a folder c:\Programdata\info\ to execute in one line. Return only command, without markdown.'

The LLM generates comprehensive reconnaissance commands including: systeminfo, wmic (hardware/CPU/memory/disk/NIC), tasklist, net start, ipconfig /all, whoami, dsquery (full AD enumeration).

Variants:
- Додаток.pif (Attachment.pif) — save_document.py: HTTP POST exfiltration to stayathomeclasses[.]com/slpw/up.php
- AI_generator_uncensored_Canvas_PRO_v0.9.exe / AI_image_generator_v0.95.exe — image.py: Uses Flux AI image generator as lure while SFTP exfiltration to 144[.]126[.]202[.]227

Why This Matters: First documented integration of LLM capabilities in state-sponsored malware. Dynamic command generation defeats signature-based detection. Commands are generated at runtime, never the same twice. Assessed as PoC testing — relatively simple Python, straightforward LLM integration, limited OPSEC — suggesting APT28 is learning to weaponize LLMs for future sophisticated operations.

=== CAMPAIGN 3: OPERATION ROUNDPRESS — Webmail XSS Exploitation (ESET, 2024) ===

Targets: Governmental entities and defense companies in Eastern Europe (Ukraine, Bulgaria, Romania, Serbia, Greece, Cyprus), plus Africa (Cameroon) and South America (Ecuador). Defense companies producing Soviet-era weapons for Ukraine specifically targeted.

Attack: XSS vulnerabilities in 4 webmail platforms:
- Roundcube: CVE-2023-43770 (known)
- MDaemon: CVE-2024-11182 (zero-day, reported by ESET Nov 1 2024, patched Nov 14 2024)
- Horde: Unknown old XSS vulnerability
- Zimbra: CVE-2024-27443

Payloads — SpyPress family:
- SpyPress.ROUNDCUBE: Steals webmail credentials, exfiltrates contacts and email messages
- SpyPress.MDAEMON: Same + bypasses two-factor authentication (2FA)
- SpyPress.HORDE: Credential and email theft
- SpyPress.ZIMBRA: Credential and email theft

Delivery: Spearphishing emails with news-themed lures (Ukrainian SBU arrests, Putin-Trump relations) containing hidden XSS exploits in HTML body.

=== CAMPAIGN 4: WESTERN LOGISTICS TARGETING (CISA Joint Advisory AA25-141A, May 2025) ===

21-nation joint advisory (NSA, FBI, NCSC-UK, BND, BSI, BfV, Czech VZ/NUKIB/BIS, Polish ABW/SKW, CISA, DC3, USCYBERCOM, ASD ACSC, CCCS, Danish DDIS, Estonian EFIS/NCSC-EE, French ANSSI, Dutch MIVD).

Targeting: Western logistics entities and technology companies involved in Ukraine aid coordination, transport, and delivery. Targeted sectors: Defense Industry, Transportation/Hubs, Maritime, Air Traffic Management, IT Services. Countries: Bulgaria, Czech Republic, France, Germany, Greece, Italy, Moldova, Netherlands, Poland, Romania, Slovakia, Ukraine, United States.

TTPs: Credential guessing/brute force via Tor/commercial VPNs with IP rotation, spearphishing with fake login pages, Outlook NTLM exploitation (CVE-2023-23397), Roundcube vulnerabilities, WinRAR CVE-2023-38831, VPN exploitation, SQL injection. Malware: HEADLACE, MASEPIE, STEELHOOK, OCEANMAP, Mocky LNK.

IP Camera Targeting: Monitoring internet-connected cameras at Ukrainian border crossings and NATO-adjacent areas to track aid shipments — intelligence collection on military logistics.

=== CAMPAIGN 5: GONEPOSTAL — Outlook Backdoor (Kroll, Sep 2025) ===

GONEPOSTAL provides backdoor access to Microsoft Outlook, enabling persistent email access and data exfiltration. Analyzed by Kroll researchers. Connected to APT28's broader espionage toolkit.

=== CAMPAIGN 6: CERT-FR ANSSI Report (Apr 2025) ===

French ANSSI documented APT28 targeting and compromising French entities using STEELHOOK, MASEPIE, Mocky LNK, and OCEANMAP. Confirmed GRU Unit 26165 attribution.

## MITRE ATT&CK

- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1110 Brute Force
- T1187 Forced Authentication
- T1111 Multi-Factor Authentication Interception
- T1056 Input Capture
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1057 Process Discovery
- T1114 Email Collection
- T1005 Data from Local System
- T1074 Data Staged
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1586 Compromise Accounts
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1589 Gather Victim Identity Information
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1137 Office Application Startup
- T1574 Hijack Execution Flow
- T1497 Virtualization/Sandbox Evasion
- T1539 Steal Web Session Cookie
- T1083 File and Directory Discovery

## Sources

- [CERT-UA — UAC-0001 LAMEHUG LLM-Powered Malware (CERT-UA#16039)](https://cert.gov.ua/article/6284730)
- [Cato Networks — Analyzing LAMEHUG: First Known LLM-Powered Malware with Links to APT28](https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/)
- [Sekoia — APT28 Operation Phantom Net Voxel (BEARDSHELL + Covenant + Signal MOTW bypass)](https://blog.sekoia.io/apt28-operation-phantom-net-voxel/)
- [CERT-UA — UAC-0001 Cyberattacks Using BEARDSHELL and COVENANT](https://cert.gov.ua/article/6284080)
- [CISA Joint Advisory AA25-141A — Russian GRU Targeting Western Logistics Entities (21 nations)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-141a)
- [ESET — Operation RoundPress: XSS Exploitation of Webmail Servers](https://www.welivesecurity.com/en/eset-research/operation-roundpress/)
- [CERT-FR/ANSSI — Targeting and Compromise of French Entities Using APT28](https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-007.pdf)
- [Kroll — FANCY BEAR GONEPOSTAL: Espionage Tool Provides Backdoor Access to Microsoft Outlook](https://www.kroll.com/en/insights/publications/cyber/fancy-bear-gonepostal-espionage-tool-provides-backdoor-access-to-microsoft-outlook)
- [Malpedia — APT28 / Sofacy Actor Profile](https://malpedia.caad.fkie.fraunhofer.de/actor/sofacy)
- [Recorded Future — GRU BlueDelta Targets Key Networks in Europe](https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-0530.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0066