The Computer Emergency Response Team of Ukraine (CERT-UA) has revealed a new set of cyber attacks targeting Ukrainian institutions with information-stealing malware.
The activity is aimed at military formations, law enforcement agencies, and local self-government bodies, particularly those located near Ukraine’s eastern border, the agency said.
The attacks involve distributing phishing emails containing a macro-enabled Microsoft Excel spreadsheet (XLSM), which, when opened, facilities the deployment of two pieces of malware, a PowerShell script taken from the PSSW100AVB (“Powershell Scripts With 100% AV Bypass”) GitHub repository that opens a reverse shell, and a previously undocumented stealer dubbed GIFTEDCROOK.
More here: https://thehackernews.com/2025/04/uac-0226-deploys-giftedcrook-stealer.html