Suspected Russian hackers deploy CANFAIL malware against Ukraine

Google Threat Intelligence Group identified a suspected Russia-linked APT conducting phishing campaigns against Ukrainian defense, government, energy, aerospace, and humanitarian organizations using CANFAIL — obfuscated JavaScript that spawns a PowerShell memory-only dropper — often delivered via Google Drive links and RAR archives disguised with double extensions; the actor leverages LLMs to craft lures and perform reconnaissance and has probed neighboring countries, with related activity noted by other labs.