Hackers are using fake drone contracts to infect Ukrainian defense enterprises

CERT-UA reports a targeted campaign (tracked as UAC-0180) using spearphishing emails disguised as drone procurement contracts to deliver malware families including Glueegg and Dropclue; the attackers used these loaders to deploy legitimate remote-management software (Atera) for remote access to Ukrainian defense enterprise systems, and CERT-UA notes the group continually updates its toolset.