Hackers hit Ukrainian state agencies, critical infrastructure with new ‘Wrecksteel’ malware

Ukraine's CERT-UA reported at least three March cyberattacks using a newly observed spying malware called Wrecksteel delivered via phishing links to public file‑sharing services and PowerShell scripts that exfiltrate documents and capture screenshots; the report names the cluster UAC-0219 and notes activity since fall 2024. Separately, a major cyberattack disrupted the national railway with custom malware, and researchers highlighted related Russian-linked campaigns such as Gamaredon targeting Ukrainian institutions.