Russian GRU Cyber Campaign Targets Western Logistics Firms Supporting Ukraine

A joint advisory attributes an active, ongoing Russian GRU Unit 26165 (APT28/Fancy Bear) cyber campaign—since early 2022—against logistics, transportation, and related IT service providers supporting Ukraine across multiple countries. The actors use spearphishing, credential attacks, CVE exploitation (notably CVE-2023-23397 and CVE-2023-38831), and malware (HEADLACE, MASEPIE) to gain persistence, exfiltrate shipment and operational data, and surveil movements via compromised IP cameras; recommended mitigations include enforcing MFA, patching, enhanced monitoring, and restricting partner trust relationships.