GhostShell Espionage Campaign Targets Ukraine’s UAV Sector with RAR Exploit A newly uncovered cyberespionage campaign, attributed to an emerging threat actor dubbed GhostShell (Malwarebox ID MB-0009), is targeting Ukraine’s unmanned aerial vehicle (UAV) ecosystem. The operation leverages a malicious RAR archive Besomar_documentation.rar containing decoy PDFs mimicking documents from Besomar, a Ukrainian fixed-wing drone developer. The attack exploits two vulnerabilities, CVE-2025-8088 and CVE-2025-6218, during archive extraction to deploy a VBS loader in the Windows Startup folder, ensuring persistence regardless of the archive’s working directory. The sample (SHA-256: 28f58061348a1c54fa6e7ff6618630259618d4afdf78514d5fccfc993797cdff) was initially misattributed to another cluster (UAC-0226) but exhibits distinct tradecraft and infrastructure. The decoy PDFs identical in size and timestamped June 6, 2026 reference UAV hardware, charging stations, and procurement documents, suggesting a tailored social engineering approach targeting military units, technical staff, procurement personnel, and defense-sector partners. According to a report by Synaptic, the campaign has been active since at least February 2026. The VBS loader acts as a bootstrapper, decoding a Base64-encoded payload in-memory and fetching two executables from cloudaxis[.]cc (/gsmft/yueu/fkvqld/tvqqwh/ushu/122.exe and update.exe). The domain, registered in February 2026, hosts a decoy public site while concealing malicious endpoints behind 404-style responses. Analysis of the executables 122.exe (SHA-256: ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3) and 22.exe (SHA-256: 8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25) reveals sophisticated encryption. 122.exe contains an encrypted overlay decrypted via a fixed XOR key (d0cd4cb8d4673e28), exposing an embedded PE. The malware employs a custom decryption routine with AVX2 and scalar code paths, using a per-byte key calculation ((i7 – 0x58) & 0xFF*) to decrypt payloads. Network telemetry shows the loader contacting cdnexpress[.]cc and posting data to an /analytics endpoint, with the server requiring client certificate authentication. GhostShell’s infrastructure avoids uniform registration patterns, complicating tracking. The campaign’s focus on Ukraine’s UAV sector combining zero-click RAR exploits, tailored decoys, robust persistence, and multi-stage encrypted payloads indicates a targeted intelligence-gathering operation rather than opportunistic cybercrime.