Earth Sirrush: A Russia-Aligned Intrusion Set With 4 Years of Evolving Espionage Tooling

TrendAI Research reports that the Russia-aligned intrusion set Earth Sirrush conducted sustained spear-phishing campaigns against Ukrainian government, defense, border guard, and logistics organizations from 2022 through July 2026, evolving from PowerShell/Go tools to compiled .NET implants (notably the ASHVEIN infostealer/RAT). The actor used diversified delivery methods—including DLL sideloading, VHDs, Notepad++ plugin abuse, and image-based steganography—reused infrastructure and artifacts (single registrar, Cloudflare fronting, shared backend IPs), and employed advanced evasion and encryption techniques; the report includes IOCs, TTP mappings, and mitigation recommendations.