Bulletproof Hosting Fuels Russia-Linked Intrusion Sets’ Global Cyber Campaign

Intrinsec reports that Russia-aligned intrusion sets UAC-0050 and UAC-0006 ran global spam campaigns in Jan–Feb 2025 targeting Ukraine and allies, blending financial theft, espionage, and psychological operations; UAC-0050 focused on financial theft and disruptive psyops (including fake bomb threats and threats against public officials), while UAC-0006 targeted accountants with SmokeLoader. The campaigns used multiple malware families and phishing lures, exploited a 7‑Zip zero-day (CVE‑2025‑0411), and relied on bulletproof hosting and offshore shell companies tied to ransomware affiliates, illustrating a convergence of cybercrime and state-aligned operations.