MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities

Cisco Talos identified a Malware-as-a-Service operation (observed from Feb–Apr 2025) that used Emmenhtal multi-stage JavaScript/PowerShell loaders to deliver Amadey and other malware, staging payloads and plugins in public GitHub repositories to evade filtering; the activity overlaps with a SmokeLoader phishing campaign targeting Ukrainian organizations and includes detailed IOCs, TTP analysis (obfuscation layers, PowerShell/AES blobs, MP4 masquerades), and mitigation recommendations.