Detect russian Attacks Targeting Ukraine: Hackers Apply the Custom Sandworm-Linked Webshell and Living-off-the-Land Tactics for Persistence

This report outlines recent Russia-linked Sandworm APT campaigns against Ukrainian organizations, describing a two-month intrusion and a separate week-long attack that relied on living-off-the-land techniques, custom webshells (e.g., Localolive), PowerShell backdoors, memory-dump scheduled tasks, and dual-use tools (including winbox64.exe) to conduct reconnaissance, credential theft, and persistent access; defenders are urged to apply relevant protections, detection rules, and threat-hunting content.