Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs

A previously undocumented, likely Russian-affiliated threat actor is targeting Ukrainian defense, government, energy, aerospace, and humanitarian organizations using phishing lures (often LLM-generated) that point to Google Drive-hosted RAR archives containing CANFAIL — an obfuscated JavaScript that launches a PowerShell memory-only dropper and displays a fake error. Google GTIG links this activity to the PhantomCaptcha campaign and notes the group's evolving capabilities via LLMs for reconnaissance, social-engineering lure creation, and C2 setup, posing a significant risk to critical infrastructure and aid organizations.