New GhostShell Hacking Group Targets Ukraine’s Drone Defense Sector

GhostShell (tracking label MB-0009) is an active cybercriminal campaign discovered targeting Ukraine’s drone sector; attackers send a malicious archive (Besomar_documentation.rar) that drops a startup script, downloads payloads (122.exe, 22.exe, update.exe) from cloudaxiscc, and uses cdnexpress.cc and a Telegram-linked C2 to exfiltrate screenshots, system identifiers, saved credentials and cryptocurrency wallet data (Vidar v2). Synaptic Systems published technical findings and cautioned against premature attribution since language and decoy content can be faked.