Hackers imitate Kremlin-linked group to target Russian entities

Knownsec researchers uncovered GamaCopy, a group impersonating the Russia-linked Gamaredon to target Russian-speaking victims with phishing documents, self-extracting 7-Zip archives and UltraVNC remote-access tools; the campaign has targeted defense and critical infrastructure and is likely connected to the state-backed actor Core Werewolf.