Gamaredon’s Spear-Phishing Assault On Ukraine’s Military

Cyble Research and Intelligence Labs (CRIL) identified an active Gamaredon APT spear-phishing campaign targeting Ukrainian military personnel that delivers malicious XHTML attachments containing obfuscated JavaScript; the script drops a RAR with an LNK that invokes mshta.exe to fetch remote .tar archives hosted via TryCloudflare, and the report provides numerous SHA256 hashes and malicious URLs as indicators of compromise.