The Awaken Likho APT group, also known as Core Werewolf and PseudoGamaredon, launched a targeted campaign using a new implant to infiltrate Russian government entities and enterprises. This campaign utilized phishing emails with malicious URLs to distribute the MeshAgent tool, enabling remote system control. An SFX archive concealed the attack by displaying a decoy document while setting up the MeshAgent to maintain a persistent connection with the attackers' server. This allowed for continuous remote access, compromising the integrity of the targeted systems. The attack underscores the evolving threat tactics and sophistication of the APT group.

The Russian-linked threat actor RomCom targeted Ukrainian government agencies and Polish entities in a sophisticated cyber attack campaign since late 2023. The attacks involved spear-phishing to deliver malware, including an updated variant of the RomCom RAT named 'SingleCamper,' as well as new downloaders and backdoors. Tools were executed for initial network reconnaissance and creating remote tunnels for command and control (C2) communications. The group performed data exfiltration, system reconnaissance, and maintained long-term access for espionage. There is also a potential for ransomware deployment to disrupt operations and generate profit. The impact includes the compromise of government systems and the risk of geopolitical instability due to the nature of the targeted entities.