Operation Silent Rotor — Rust-based Spear-Phishing Loader Targeting Eurasian Unmanned Aviation Sector Ahead of Moscow UAV Forum — Threadlinqs Intelligence
As of 2026-05-30, Operation Silent Rotor — Rust-based Spear-Phishing Loader Targeting Eurasian Unmanned Aviation Sector Ahead of Moscow UAV Forum is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0466 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
SEQRITE Labs disclosed Operation Silent Rotor on 2026-05-06: a targeted spear-phishing campaign delivering a 64-bit Rust Windows loader ("Подтверждение заказа продукции ЦАИ.exe") inside a 'cai
Operation Silent Rotor is an active, regionally focused spear-phishing campaign uncovered by SEQRITE Labs and publicly documented on 6 May 2026. The campaign weaponises the XIII Eurasian International Forum 'Unmanned Aviation 2026' — scheduled for Moscow on 23 April 2026 — as a social-engineering pretext to lure Russian-speaking unmanned aviation system (UAS) and aeronautical information services professionals into opening a malicious archive ('cai partner.zip') delivered via spear-phishing email.
The archive contains a 64-bit Rust-compiled Windows loader named 'Подтверждение заказа продукции ЦАИ.exe' ("Confirmation of CAI product order.exe") accompanied by three benign-appearing decoys: 'Certificate of translation.PDF', a Russian-language DOCX confirming a long-term CAICA products order tied to the Unmanned Aviation 2026 forum, and 'summary_order_cai_final.xlsx'. On execution, the loader displays an embedded DOCX decoy to maintain the social-engineering cover while it performs host fingerprinting in the background.
Victim profiling is implemented in pure Rust. The loader resolves GetComputerNameExW for the hostname and GetVolumeInformationW for the C: volume serial number, XOR-combines the two values, converts the result to a decimal string and uses it as a unique machine ID. It then reads the USER, USERDNSDOMAIN, COMPUTERNAME and USERPROFILE environment variables, and walks every active interface via GetAdaptersAddresses to gather IPv4 addresses and DNS server entries. The collected metadata is serialised into JSON with the serde_json crate, XOR-encrypted with a static key, and POSTed over HTTPS to https[:]//cdn[.]kleymarket[.]ru:443 (resolving at the time of analysis to 45.142.36.76 on AS48347 'MTW-AS', Moscow, Russia).
The C2 returns an XOR-encrypted blob whose first two values, after decoding, supply a 256-bit AES key and parameters used to decrypt subsequent blocks of payload. The decrypted second-stage executable is written to disk under %USERPROFILE%\Documents\ or C:\Users\Public\Documents\ as a six-character random file name with a .exe extension, using NtWriteFile, and then launched via CreateProcessA. SEQRITE telemetry shows the operator-controlled domain kleymarket[.]ru was registered roughly nine days prior to analysis and resolved to 45.142.36.76, 92.62.113.232 and 89.108.110.154 — all hosted in Russian infrastructure — strongly suggesting purpose-built tradecraft rather than reuse of existing crimeware infrastructure.
While attribution is currently unconfirmed, the combination of Russian-language lures, regional targeting of Russian-speaking UAS professionals, Russian hosting (MTW-AS), tight thematic timing against a Moscow-hosted UAV forum, and the use of a custom Rust loader with bespoke hybrid XOR/AES-256 cryptography are consistent with state-aligned cyber-espionage tradecraft against the unmanned aviation supply chain. Defenders in the UAS, aerospace and aeronautical-information-services sectors across Russia, Tajikistan, the wider CIS, the Middle East and Europe should treat this as a HIGH-severity, actively exploited intrusion vector and prioritise the published file, network and behavioural IOCs for retrospective hunting and prevention.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-94
Target sectors: unmanned-aviation, aerospace, aeronautical-information-services, defense, government, supply-chain
Target regions: Russia, Tajikistan, Central Asia, Middle East, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1204.002, T1059.003, T1106, T1036.004, T1027, T1140, T1082, T1016