Russian GRU Targeting Western Logistics Entities and Technology Companies

Originally Published June 26, 2025

I. Targeted Entities

• Western logistics entities and technology companies involved in transportation and coordination of aid to Ukraine.
• Defense industry entities
• Transportation hubs (ports, airports)
• Maritime sectors
• Air traffic management systems
• IT services

II. Introduction

Since early 2022, the Russian General Staff Main Intelligence Directorate (GRU), specifically its 85th Main Special Service Center (85th GTsSS), also identified as APT28, Fancy Bear, Forest Blizzard, and BlueDelta, has been actively conducting cyber espionage operations against Western logistics and technology entities. This ongoing campaign primarily targets entities facilitating foreign assistance to Ukraine, highlighting a strategic effort to monitor, disrupt, or influence the flow of aid to Ukraine.

Attack Details: The GRU unit 26165 has leveraged sophisticated cyber espionage tactics, including credential guessing, spearphishing, exploitation of known vulnerabilities, and abuse of internet-facing infrastructure such as corporate VPNs. Notable vulnerabilities exploited in this campaign include CVE-2023-23397 (Outlook NTLM), CVE-2023-38831 (WinRAR), and several Roundcube vulnerabilities (CVE-2020-12641, CVE-2020-35730, CVE-2021-44026).

Recent analysis highlights the GRU’s use of geopolitical event lures, notably exploiting the Israel-Hamas conflict to deliver the HEADLACE malware, enabling comprehensive network penetration and persistent espionage (Mühr, Zaboeva, & Fasulo, 2025).

III. MITRE ATT&CK Framework

Initial Access:

• Exploitation of Public-Facing Applications (T1190)
  • Exploited known vulnerabilities in publicly accessible applications such as Microsoft Exchange and corporate VPNs to achieve initial entry.
• Spearphishing (T1566)
  • Distributed carefully crafted phishing emails using contextually relevant geopolitical lures (e.g., Israel-Hamas conflict) to trick users into executing malicious payloads.
• Brute Force and Credential Guessing (T1110)
  • Conducted systematic credential guessing and brute force attacks targeting exposed remote services, including RDP and VPN logins.

Execution:

• Command and Scripting Interpreter (T1059)
  • Command and Scripting Interpreter (T1059) is a highly prevalent execution technique in MITRE ATT&CK that adversaries use to run arbitrary commands, scripts, or binaries on target systems via built-in interpreters like PowerShell, cmd.exe, Bash, Python, JavaScript, AppleScript, Visual Basic, and more.
• User Execution (T1204)
  • Deployed malicious attachments and phishing links designed to prompt users into inadvertently executing malicious scripts or payloads.

Persistence:

• Scheduled Task (T1053)
  • Established scheduled tasks to regularly execute malicious scripts and maintain long-term access.
• • Shortcut Modification (T1547.009)
• o Altered desktop shortcuts to point to malicious executables, ensuring persistent and subtle execution during regular user operations.

Privilege Escalation:

• Abuse of Elevation Control Mechanisms (T1548)
  • Exploited software vulnerabilities, notably CVE-2023-23397, enabling unauthorized elevation of privileges to access sensitive resources.

Credential Access:

• Credential Dumping (T1003)
  • Harvested credentials through techniques such as memory scraping, registry dumps, and exploitation of NTLM hashes.
• Exploitation of NTLM Vulnerability (CVE-2023-23397)
  • CVE 2023 23397 is a critical “zero touch” elevation-of-privileges vulnerability in Microsoft Outlook for Windows that allows attackers to exfiltrate a user’s Net NTLMv2 hash without any user interaction.

Lateral Movement:

• Remote Desktop Protocol (T1021.001)
  • Employed Remote Desktop Protocol to navigate laterally through compromised networks, enhancing the attacker’s reach and access.
• Use of tools such as Impacket and PsExec
  • Impacket is a Python-based collection of modules that allows attackers to craft and send network protocol packets, making it particularly useful for exploiting protocols like SMB, RDP, and Kerberos. It’s frequently used to perform pass-the-hash, NTLM relay, and DCSync attacks.
• PsExec, part of Microsoft Sysinternals, enables remote execution of processes and is commonly used by adversaries to run commands or deploy payloads across a network without needing remote desktop access.

Discovery:

• Active Directory Enumeration (T1087)
  • Mapped organizational structures by enumerating Active Directory objects to identify high-value targets.
• Network Service Scanning (T1046)
  • Conducted extensive internal scans post-compromise to locate vulnerable or exploitable network services.

Command and Control:

• Application Layer Protocol (T1071)
  • Used standard protocols such as HTTP(S) and DNS to blend malicious traffic with legitimate communications, complicating detection efforts.
• Legitimate Web Services (T1102)
  • Leveraged trusted cloud and hosting services to host command and control infrastructure, reducing suspicion and bypassing traditional network defenses.

Exfiltration:

• Data Exfiltration via Command and Control Channel (T1041)