A U.S.-based civil engineering firm specializing in Ukraine-related infrastructure projects fell victim to a highly targeted cyberattack orchestrated by Russian GRU Unit 29155 in September 2025. The threat actors exploited fake browser update pop-ups to deploy SocGholish malware, which then delivered the RomCom Mythic Agent loader within minutes of initial infection. The attack leveraged compromised legitimate websites to inject malicious JavaScript, tricking employees into downloading a fake 'msedge.dll' payload disguised as a browser update.The payload executed only when the victim’s system matched a predefined domain, indicating precision targeting. Once activated, it established a connection to Mythic C2 servers, granting attackers remote access for potential espionage or data exfiltration. While Arctic Wolf’s Aurora Endpoint Defense detected and quarantined the payload before full compromise, the incident highlights the evolving threat landscape where malware-as-a-service (SocGholish)—previously associated with ransomware—is now repurposed for state-sponsored cyber operations. The attack’s link to GRU-affiliated groups suggests motives beyond financial gain, likely aiming to disrupt pro-Ukrainian entities or gather intelligence on critical infrastructure projects. The use of bulletproof hosting and advanced obfuscation techniques further complicates attribution and mitigation.