Follow us on Bluesky, Twitter (X) and Facebook at @Hackread

Cyble exposed a Sandworm-linked espionage campaign targeting Belarusian military UAV personnel. It uses a malicious LNK file to deploy OpenSSH over Tor obfs4 for stealthy, persistent remote access.

SEQRITE exposed SkyCloak, an espionage campaign targeting Russian/Belarusian military personnel. It uses malicious LNK files to deploy OpenSSH over Tor obfs4 bridges for stealthy, persistent remote access.

Operation SkyCloak targets Russian/Belarus defense with a multi-stage backdoor using OpenSSH and Tor/obfs4 for stealthy C2. The malware checks for sandboxes before execution.

RSF uncovers ResidentBat, a Belarusian KGB spyware physically installed during interrogations to hijack encrypted messages and monitor journalists.

At a glance Actor: UNC1151 (Ghostwriter / Frosty Neighbor) Activity type: Spear-phishing and credential theft Targets: Belarusian politicians and Ukrainian web portals Scale: Broad multi-national …