Cyber-Espionage Group HeartlessSoul Targets Russian Aviation and Government Sectors A cyber-espionage campaign attributed to the group HeartlessSoul has been actively targeting Russian government agencies and aviation industry organizations since at least September 2025, according to a report by Kaspersky. The attackers are focused on stealing geospatial intelligence (GIS) data, including detailed mapping of infrastructure, terrain, and strategic facilities information critical to engineering, industrial, and defense sectors. HeartlessSoul employs phishing emails containing malicious archive files and malvertising campaigns to distribute malware. The group has also created fake aviation-related websites and domains to trick victims into downloading infected software installers. In one case, attackers exploited SourceForge, a legitimate software hosting platform, to distribute a trojanized version of GearUP, a tool for improving online gaming connections. Unsuspecting users instead received spyware capable of harvesting screenshots, keystrokes, browser data, and Telegram credentials, as well as determining device locations. Kaspersky’s investigation revealed overlaps between HeartlessSoul and another hacking group, Goffee, which has previously targeted Russian systems and specialized in exfiltrating data from connected flash drives. The connection suggests potential coordination or shared operational ties. While the primary focus appears to be the aviation sector, independent analyst Oleg Shakirov noted that the malware was also distributed through files disguised as FPV drone simulators and tools for bypassing Starlink restrictions. This could indicate broader targeting of drone operators, military personnel, or communications specialists, expanding the campaign’s potential impact beyond aviation.