Trojanized ESET Installers - Kalambur Backdoor Targets Ukraine

Trojanized ESET installers are being used to deliver the Kalambur backdoor in a Russia-aligned phishing campaign targeting Ukrainian organizations. Trojanized ESET installers are distributed via spear-phishing emails and Signal messages that impersonate the Slovak security vendor and claim to provide urgent remediation tools. When victims download from domains such as esetsmart[.]com or esetscanner[.]com, they receive a bundle that combines legitimate ESET AV components with a C# backdoor known as Kalambur, also tracked as SUMBUR. Trojanized ESET installers allow the InedibleOchotense threat cluster, linked to Sandworm sub-groups UAC-0212 and UAC-0125, to establish persistent access to Ukrainian government, energy, logistics, and education networks. Kalambur uses the Tor anonymity network for command-and-control, can deploy OpenSSH, and enables remote desktop access on port 3389, giving operators broad control over compromised systems. The same reporting period also saw Sandworm deploy multiple wiper families, including ZEROLOT and Sting, against Ukrainian targets, underscoring the destructive intent behind this access. For defenders in Ukraine and allied countries, Trojanized ESET installers highlight a recurring pattern: adversaries abuse trust in widely deployed security software to gain initial access and prepare follow-on destructive operations. Security teams must combine rigorous verification of installer provenance with monitoring for Tor-based C2, unexpected RDP enablement, and secondary payloads associated with Sandworm-linked campaigns.