Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war

ESET documents 'Operation Texonto', a Russian-aligned disinformation and spearphishing campaign (Nov–Dec 2023) that used lookalike Ukrainian government domains, malicious PDFs and fake Microsoft login pages to spread propaganda and steal Office 365 credentials; operators later reused infrastructure to send Canadian pharmacy spam. The report includes IoCs (domains, IPs, emails, file hashes), MITRE ATT&CK mappings, and contextual analysis of targeting and likely motives.