Google Ties Suspected Russian Actor to CANFAIL Malware Attacks on Ukrainian Orgs
ID: CDB-APEX-1771161593 | Risk: 8.0/10 | Generated: 1771161593
Executive Summary (BLUF)
A previously undocumented threat actor has been attributed to attacks targeting Ukrainian organizations with malware known as CANFAIL. Google Threat Intelligence Group (GTIG) described the hacking group as possibly affiliated with Russian intelligence services. The threat actor is assessed to have targeted defense, military, government, and energy organizations within the Ukrainian regional and...
Tactical Correlation (Diamond Model)
Credential Access, Exfiltration, Command and Control, Impact, Initial Access
8.8.8.8
Visual Geographic Intelligence
GLOBAL THREAT DISTRIBUTION
* Red pulses indicate active IoC origins triaged in this sweep.
[+] Open Technical Annex (IOCs & Raw Data)
IPV4: 8.8.8.8
SHA256: fba4883bf4f73aa48a957d894051d78e0085ecc3170b1ff50e61ccec6aeee2cd, 1d04e33009bcd017898b9e1387e40b5c04279c02ebc110f12e4a724ccdb9e4fb, 96babe53d6569ee3b4d8fc09c2a6557e49ebc2ed1b965abda0f7f51378557eb1, 70bb799557da5ac4f18093decc60c96c13359e30f246683815a512d7f9824c8f, 7b9e12e3561285181634ab32015eb653ab5e5cfa157dd16cdd327104b258c332, 94bf0aba5f9f32b9c35e8dfc70afd8a35621ed6ef084453dc1b10719ae72f8e2, a4069aa29628e64ea63b4fb3e29d16dcc368c5add304358a47097eedafbbb565, 8eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3, c733d85f445004c9d6918f7c09a1e0d38a8f3b37ad825cd544b865dba36a1ba6, 1845a910dcde8c6e45ad2e0c48439e5ab8bbbeb731f2af11a1b7bbab3bfe0127, C20BABA26EBB596DE14B403B9F78DDC3C13CE9870EEA332476AC2C1DD582AA07, f51b3d054995803d04a754ea3ff7d31823fab654393e8054b227092580be43db, A4F0B68052E8DA9A80B70407A92400C6A5DEF19717E0240AC608612476E1137E, 2814b33ce81d2d2e528bb1ed4290d665569f112c9be54e65abca50c41314d462, a70af759e38219ca3a7f7645f3e103b13c9fb1db6d13b68f3d468b7987540ddf, 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b, 18a507bf1c533aad8e6f2a2b023fbbcac02a477e8f05b095ee29b52b90d47421, 8b448f47e36909f3a921b4ff803cf3a61985d8a10f0fe594b405b92ed0fc21f1, a1abc3d11c16ae83b9a7cf62ebe6d144dfc5e19b579a99bad062a9d31cf30bfe, da692ea0b7f24e31696f8b4fe8a130dbbe3c7c15cea6bde24cccc1fb0a73ae9e, e4d6fe517cdf3790dfa51c62457f5acd8cb961ab1f083de37b15fd2fddeb9b8f, 64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983, 68A49D5A097E3850F3BB572BAF2B75A8E158DADB70BADDC205C2628A9B660E7A, 73a9a1e38ff40908bcc15df2954246883dadfb991f3c74f6c514b4cffdabde66, 70EE22D394E107FBB807D86D187C216AD66B8537EDC67931559A8AEF18F6B5B3, 88f26f3721076f74996f8518469d98bf9be0eaee5b9eccc72867ebfc25ea4e83, 7a43789216ce242524e321d2222fa50820a532e29175e0a2e685459a19e09069, ff7ad2376ae01e4b3f1e1d7ae630f87b8262b5c11bc5d953e1ac34ffe81401b5, dfb5ba578b81f05593c047f2c822eeb03785aecffb1504dcb7f8357e898b5024, 28c3c50d115d2b8ffc7ba0a8de9572fbe307907aaae3a486aabd8c0266e9426f, 1a70f4eef11fbecb721b9bab1c9ff43a8c4cd7b2cafef08c033c77070c6fe069, e86bb8361c436be94b0901e5b39db9b6666134f23cce1e5581421c2981405cb1, FAFCD5404A992850FFCFFEE46221F9B2FF716006AECB637B80E5CD5AA112D79C, d535bdc9970a3c6f7ebf0b229c695082a73eaeaf35a63cd8a0e7e6e3ceb22795, 44887125aa2df864226421ee694d51e5535d8c6f70e327e9bcb366e43fd892c1, 4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5, d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb, 97931d2e2e449ac3691eb526f6f60e2f828de89074bdac07bd7dbdfd51af9fa0, f2bbba1ea0f34b262f158ff31e00d39d89bbc471d04e8fca60a034cabe18e4f4
MD5: 64e3a3458b3286caaac821c343d4b208, C9F4C41C195B25675BFA860EB9B45945, de778443619f37e2224898a9a800fa78, 33e692f435d6cf3c637ba54836c63373, 0777EA1D01DAD6DC261A6B602205E2C8, 20b70dac937377b6d0699a44721acd80, feda15d3509b210cb05eacc22485a78c, B7B3647E06F23B9E83D0B1CCE3E71642, eba9ae70d1b22de67b0eba160a6762d8
DOMAIN: siet.py, cwe.mitre.org, www.hhs.gov, web.xml, www.securityweek.com, supo.fi, bsi.bund.de, conhost.exe, linux-exploit-suggester2.pl, t1.sh, blog.sekoia.io, putty.exe, www.etsi.org, bfv.bund.de, Cisco-Secure-Client.exe, doi.org, learn.microsoft.com, t.py, conhost.dll, cisa.gov, www.nsa.gov, pages.nist.gov, commands.log, cleanup.dll, SophosendpointAgent.exe, 1.txt, www.cyber.gov.au, Rar.exe, difxepi.dll, GlobalProtect.exe, Handx.ashx, 20METHODOLOGY.PDF, www.darkreading.com, AnyDesk.exe, AA25-203A-interlock-stix.xml, ApplicationHost.config, 20NVIC.pdf, autorun.log, www.cisecurity.org, uscg.mil, mail.cisa.dhs.gov, PsExec.exe, www.tripwire.com, iox.rar, www.legislation.gov.uk, nukib.gov.cz, Policies.cfm, cyber.int, AnyConnectVPN.exe, 20CTIME.pdf, www.cnss.gov, aw.gov.pl, AA25-203A-interlock-stix.json, cyber.gov.au, blogs.microsoft.com, tac.pcap, webujgd.lnk, tar.gz, 20copy.pdf, 362.html, www.epa.gov, www.energy.gov, www.cisa.gov, 20DEVICES.PDF, tclproxy.tcl, best-practices-for-event-logging-and-threat-detection.pdf, www.ic3.gov, www.isa.org, agent.tar, guidance-mobile-communications-best-practices.pdf, www.fbi.gov, www.bleepingcomputer.com, conhost.txt, hhs.gov, assets.publishing.service.gov.uk, smtp.gc.ca, RinqQ.exe, Starship.exe, skw.gov.pl, www.cisco.com, csrc.nist.gov, pack.jar, github.com, 1.pcap, niccs.cisa.gov, clickfix-attacks-sector-alert-tlpclear.pdf, ofcom.org.uk, cyber.gc.ca, map.tcl, cisa.dhs.gov, c.bat, FortiClient.exe, ScreenConnect.ClientService.exe, machine.config, www.naruc.org, DC3.DCISE, StorageExplorer.exe, www.ncsc.gov.uk, processhacker-2.39-bin.zip, 220270-use-cisco-ios-xe-hardening-guide.html, qrpce91.exe.asd, klg.dll, blog.talosintelligence.com, jar.jar, 95.html, rundll32.exe, www.uscg.mil, nsarchive.gwu.edu, cyber.go.jp, RingQ.rar, TCLproxy.tcl, 13608-21.html, NIST.SP, CSA-CISCO-SMART-INSTALL-PROTOCOL-MISUSE.PDF, KrebsOnSecurity.com, ncsc.govt.nz, Aisa.exe, www.cve.org, autoservice.dll, Webex.exe, us.af.mil, www.mcafee.com, 20Activity.jpg, aa.sh, Ivanti-Secure-Access-Client.exe, mm.sh, agent.zip, mycap.pcap, fact-sheet-implementing-phishing-resistant-mfa-508c.pdf, ld-linux-x86-64.so, nsa.gov, Last.txt, stopransomware.gov, SophosScaner.exe, puttyportable.exe, www.europol.europa.eu, attack.mitre.org, WinSCP-6.3.5-Setup.exe, hygiene-improvement-after-conducting-proactive-threat-hunt-508c.pdf, start.exe, sec.cloudapps.cisco.com, resolv.conf, Autostart.exe, applicationHost.config, report.ncsc.gov.uk, main.go, cyber.nsa.gov, media.defense.gov, d3fend.mitre.org, Stopransomware.gov, PuTTYPortable.zip, sp800-63b.html, cisecurity.org, ASP.NET, tmp41.wasd, agentu.exe, www.idfa.org, cht.exe, RingQ.exe, www.ofcom.org.uk, Sysmon.sys, PuTTY.exe, aaa.zip, bnd.bund.de, Base.php, myservices.cisa.gov, www.sicurezzanazionale.gov.it, web.config, cas.docs.cisecurity.org, aa25-203a-stopransomware-interlock-072225.pdf, iexplore.exe
CVE: CVE-2023-20273, CVE-2024-36401, CVE-2024-21887, CVE-2023-46805, CVE-2026-1731, CVE-2026-24061, CVE-2023-20198, CVE-2026-21962, CVE-2018-0171, CVE-2024-3400, CVE-2016-5195