A sophisticated spear-phishing campaign targeted Russian and Belarusian military personnel, specifically those in the Russian Airborne Forces (VDV) and Belarusian Special Forces (UAV/drone operators). The attack employed weaponized LNK files disguised as military-themed PDFs (e.g., ‘ТЛГ на убытие на переподготовку.pdf.lnk’ and ‘Исх №6626 Представление на назначение на воинскую должность.pdf.lnk’). Upon execution, the malware established persistence via scheduled tasks, deployed a hidden SSH service (port 20321) with RSA-key authentication for threat actor access, and created a Tor hidden service to exfiltrate data, enable RDP/SMB lateral movement, and maintain full interactive control over compromised systems. The campaign’s infrastructure and tactics—including custom Tor pluggable transports and SSHD configurations—mirrored those of Russian APT groups (e.g., Sandworm/APT44, APT28), though attribution remains unconfirmed. Researchers noted parallels to pro-Ukraine APTs (Angry Likho, Awaken Likho) but could not definitively link the operation. The attack’s focus on military units specializing in drones and airborne operations suggests strategic espionage or sabotage objectives, potentially threatening operational security, command-chain integrity, and classified intelligence. The use of Tor and encrypted channels indicates a high likelihood of sustained, undetected access to sensitive defense networks.

The EastWind campaign utilized sophisticated backdoors to target Russian entities, compromising government and IT organizations' security. Malware delivered via phishing emails installed PlugY and GrewApacha backdoors on victims' systems. The ill-intended actors leveraged public services like Dropbox and LiveJournal for command and control, executing wide-ranging functions including data theft and system monitoring. The implication of APT groups APT27 and APT31 indicates the sharing of advanced cyber-espionage tools, which signifies a higher threat level due to the coordinated and resourceful nature of the attackers. The campaign resulted in the unauthorized access and potential exfiltration of sensitive information, posing a critical concern for national security and the affected institutions' operational integrity.