APT28 Expands Financial Sector Targeting with Advanced Phishing and Custom Malware

APT28 (Fancy Bear) ran a sophisticated spearphishing campaign against financial institutions from January 15 to March 31, 2023, reportedly compromising dozens of systems. What's notable: the campaign integrated a custom malware loader alongside established banking trojans like Gozi and TrickBot—elevated operational sophistication. Highly tailored spearphishing emails bypassed conventional security, delivering malware that exploited CVE-2023-1234 and CVE-2023-5678 for initial footholds. The custom loader provided persistent backdoor access and facilitated deployment of additional payloads. Mandiant analysis suggests objectives extended beyond typical credential harvesting—attackers specifically targeted proprietary trading data, indicating strategic interest in market intelligence or potential financial manipulation.

APT28 Expands Financial Targeting with Custom Loader + Banking Trojans

Detect russian Attacks Targeting Ukraine: Hackers Apply the Custom Sandworm-Linked Webshell and Living-off-the-Land Tactics for Persistence

Russia-linked Sandworm (UAC-0082, UAC-0145, APT44, Seashell Blizzard) conducted a two-month campaign against a major Ukrainian business services company and a week-long attack on a state entity starting late June 2025. What's interesting: attackers primarily used Living-off-the-Land techniques and dual-use tools rather than large-scale malware. They deployed Localolive, a custom webshell previously linked to Sandworm in the BadPilot campaign. Initial access via webshells on publicly accessible servers (likely unpatched vulnerabilities), followed by reconnaissance commands (whoami, systeminfo, tasklist, net group). Attackers disabled Windows Defender for Downloads folder, created scheduled tasks for periodic memory dumps to extract credentials, then targeted two IT personnel workstations specifically for deeper network access.

📂 Apt

APT28 Expands Financial Targeting with Custom Loader + Banking Trojans

Sandworm's Ukraine Campaign: Custom Webshell + LotL Persistence