Hackers phish finance orgs using trojanized Minesweeper clone

CERT‑UA and CSIRT‑NBU report a phishing campaign attributed to actor UAC‑0188 that hides malicious Python code inside a legitimate Minesweeper clone; the embedded base64 payload decodes to an MSI installer for SuperOps RMM, enabling remote access. At least five potential breaches of financial and insurance organizations in Europe and the US were identified, and the agencies published IOCs and guidance to treat SuperOps artifacts or network calls as indicators of compromise.