Cyber spies target Russian aviation firms to steal satellite and GPS data

Kaspersky reports that the HeartlessSoul cyber-espionage group has been active since at least September 2025, targeting Russian government agencies and aviation-related organizations to exfiltrate geospatial (GIS) data. The actors use phishing, malicious advertising, fake aviation-related domains, and fraudulent SourceForge uploads to distribute spyware that captures screenshots, keystrokes, browser data, Telegram credentials and device location; researchers also identified links to the Goffee group and possible targeting of drone or satellite-communications users.