FlyingYeti APT Serves Up Cookbox Malware Using WinRAR

Cloudflare observed a month-long FlyingYeti phishing campaign targeting Ukrainian civilians that used debt-related lures to deliver the PowerShell-based Cookbox malware by exploiting WinRAR CVE-2023-38831; attackers performed detailed reconnaissance on communal payment processes, adapted hosting (GitHub, Pixeldrain, Filemail) after takedowns, employed DDNS-based C2 and persistence, and were partially disrupted by Cloudflare and GitHub actions — the report includes IOCs and mitigation guidance (zero trust, EDR, patching, email defenses).