Russian Hacker Breaches Companies, Sells Their Access and Spies on Ukrainian Military Sites

CloudSEK discovered a Russian-speaking operator conducting large-scale scans and exploiting at least a dozen vulnerabilities in widely used appliances to gain initial access, harvest credentials and create persistent footholds; access was staged for resale to ransomware groups and later repurposed for targeted espionage against Ukrainian defence and aerospace organizations, using web shells, Sliver C2, Kerberos ticket forging and exposed camera feeds — the report includes IoCs and remediation guidance.