Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs
ID: CDB-APEX-1771161366 | Risk: 8.0/10 | Generated: 1771161366
Executive Summary (BLUF)
A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group (GTIG) described the hacking group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have targeted defense, military, government, and energy organizations within the Ukrainian regional and...
Tactical Correlation (Diamond Model)
Command and Control, Initial Access, Credential Access, Exfiltration, Impact
8.8.8.8
Visual Geographic Intelligence
GLOBAL THREAT DISTRIBUTION
* Red pulses indicate active IoC origins triaged in this sweep.
[+] Open Technical Annex (IOCs & Raw Data)
IPV4: 8.8.8.8
SHA256: f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db, 4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5, 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983, 8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3, c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6, da692ea0b7f24e31696f8b4fe8a130dbbe3c7c15cea6bde24cccc1fb0a73ae9e, f2bbba1ea0f34b262f158ff31e00d39d89bbc471d04e8fca60a034cabe18e4f4, 18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421, 68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A, dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024, fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd, a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf, 94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2, 8b448f47e36909f3a921b4ff803cf3a61985d8a10f0fe594b405b92ed0fc21f1, 88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83, 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069, 7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069, 2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462, 7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332, 73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66, 70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f, a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565, d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb, 1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb, a1abc3d11c16ae83b9a7cf62ebe6d144dfc5e19b579a99bad062a9d31cf30bfe, e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f, 70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3, 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127, A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E, 97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0, 44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1, FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C, 96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1, d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795, 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b, C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07, 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f, ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5, e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1
MD5: eba9ae70d1b22de67b0eba160a6762d8, 33e692f435d6cf3c637ba54836c63373, 20b70dac937377b6d0699a44721acd80, B7B3647E06F23B9E83D0B1CCE3E71642, 0777EA1D01DAD6DC261A6B602205E2C8, 64e3a3458b3286caaac821c343d4b208, feda15d3509b210cb05eacc22485a78c, de778443619f37e2224898a9a800fa78, C9F4C41C195B25675BFA860EB9B45945
DOMAIN: t1.sh, krebsonsecurity.com, www.cisa.gov, uscg.mil, applicationHost.config, hygiene-improvement-after-conducting-proactive-threat-hunt-508c.pdf, difxepi.dll, Webex.exe, GlobalProtect.exe, web.xml, Cisco-Secure-Client.exe, cwe.mitre.org, jar.jar, Last.txt, niccs.cisa.gov, cyber.gc.ca, nsarchive.gwu.edu, www.nsa.gov, tclproxy.tcl, aw.gov.pl, RinqQ.exe, 20copy.pdf, 1.pcap, aa.sh, NIST.SP, 362.html, main.go, PuTTYPortable.zip, nukib.gov.cz, learn.microsoft.com, report.ncsc.gov.uk, AA25-203A-interlock-stix.xml, AA25-203A-interlock-stix.json, iexplore.exe, puttyportable.exe, 13608-21.html, agentu.exe, iox.rar, www.uscg.mil, github.com, smtp.gc.ca, csrc.nist.gov, www.sicurezzanazionale.gov.it, machine.config, conhost.exe, ofcom.org.uk, web.config, resolv.conf, www.ic3.gov, ld-linux-x86-64.so, 20NVIC.pdf, agent.tar, SophosScaner.exe, cas.docs.cisecurity.org, PsExec.exe, www.cyber.gov.au, Sysmon.sys, www.bleepingcomputer.com, blogs.microsoft.com, Rar.exe, Base.php, myservices.cisa.gov, www.hhs.gov, www.epa.gov, putty.exe, hhs.gov, autorun.log, www.securityweek.com, autoservice.dll, pack.jar, Stopransomware.gov, tmp41.wasd, www.etsi.org, AnyDesk.exe, WinSCP-6.3.5-Setup.exe, DC3.DCISE, klg.dll, www.cisecurity.org, Ivanti-Secure-Access-Client.exe, processhacker-2.39-bin.zip, qrpce91.exe.asd, webujgd.lnk, blog.talosintelligence.com, StorageExplorer.exe, sec.cloudapps.cisco.com, conhost.txt, www.legislation.gov.uk, skw.gov.pl, us.af.mil, ncsc.govt.nz, RingQ.exe, Policies.cfm, ASP.NET, conhost.dll, Starship.exe, cisa.dhs.gov, www.cve.org, supo.fi, www.tripwire.com, www.naruc.org, 20CTIME.pdf, cyber.go.jp, pages.nist.gov, ApplicationHost.config, SophosendpointAgent.exe, aaa.zip, Autostart.exe, www.darkreading.com, commands.log, start.exe, d3fend.mitre.org, PuTTY.exe, cleanup.dll, tar.gz, assets.publishing.service.gov.uk, www.energy.gov, www.idfa.org, www.ncsc.gov.uk, FortiClient.exe, www.cisco.com, Aisa.exe, cht.exe, stopransomware.gov, bsi.bund.de, www.fbi.gov, doi.org, rundll32.exe, bfv.bund.de, map.tcl, aa25-203a-stopransomware-interlock-072225.pdf, c.bat, 95.html, blog.sekoia.io, www.cnss.gov, mycap.pcap, sp800-63b.html, best-practices-for-event-logging-and-threat-detection.pdf, cyber.gov.au, RingQ.rar, www.ofcom.org.uk, CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF, mm.sh, AnyConnectVPN.exe, mail.cisa.dhs.gov, media.defense.gov, Handx.ashx, siet.py, guidance-mobile-communications-best-practices.pdf, www.europol.europa.eu, tac.pcap, cisa.gov, TCLproxy.tcl, agent.zip, cyber.int, ScreenConnect.ClientService.exe, 20DEVICES.PDF, attack.mitre.org, linux-exploit-suggester2.pl, cisecurity.org, 20Activity.jpg, 1.txt, www.isa.org, t.py, fact-sheet-implementing-phishing-resistant-mfa-508c.pdf, 20METHODOLOGY.PDF, cyber.nsa.gov, bnd.bund.de, www.mcafee.com, clickfix-attacks-sector-alert-tlpclear.pdf, nsa.gov, 220270-use-cisco-ios-xe-hardening-guide.html
CVE: CVE-2024-36401, CVE-2024-21887, CVE-2023-46805, CVE-2023-20198, CVE-2026-24061, CVE-2023-20273, CVE-2026-21962, CVE-2018-0171, CVE-2026-1731, CVE-2016-5195, CVE-2024-3400