{"id":3369,"date":"2025-10-24T22:51:37","date_gmt":"2025-10-24T22:51:37","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2025\/10\/24\/blitz-spear-phishing-campaign-targets-ngos-supporting-ukraine\/"},"modified":"2025-10-24T22:51:37","modified_gmt":"2025-10-24T22:51:37","slug":"blitz-spear-phishing-campaign-targets-ngos-supporting-ukraine","status":"publish","type":"post","link":"https:\/\/ft365.org\/index.php\/2025\/10\/24\/blitz-spear-phishing-campaign-targets-ngos-supporting-ukraine\/","title":{"rendered":"Blitz Spear Phishing Campaign Targets NGOs Supporting Ukraine"},"content":{"rendered":"
\n
\n

Aid groups involved in Ukraine\u2019s war relief efforts and Ukrainian regional government administrations were targeted by a single-day spear phishing attack, a SentinelOne report has revealed.<\/p>\n

The campaign, dubbed PhantomCaptcha, was conducted on October 8 and delivered a WebSocket remote access Trojan (RAT) hosted on Russian-owned infrastructure that enables arbitrary remote command execution, data exfiltration and potential deployment of additional malware.<\/p>\n

Targets included individual members of the International Red Cross, Norwegian Refugee Council, UNICEF, Council of Europe\u2019s Register of Damage for Ukraine and Ukrainian government administrations in the Donetsk, Dnipropetrovsk, Poltava and Mikolaevsk regions, according to the SentinelOne report published on October 22.<\/p>\n

Threat actors used emails impersonating the Ukrainian President\u2019s Office carrying weaponized PDFs, luring victims into executing malware via a ClickFix-style fake Cloudflare CAPTCHA page.<\/p>\n

Read more: What is ClickFix and How to Prevent It<\/em><\/p>\n

Clickfix-Style CAPTCHA Lure<\/strong><\/h2>\n

Researchers at SentinelOne\u2019s SentinelLabs investigated the PhantomCaptcha campaign after they received intelligence from Ukraine\u2019s Digital Security Lab.<\/p>\n

They found a sophisticated multi-stage spear phishing operation that took six months of preparation.<\/p>\n

The initial access lure was an 8-page PDF document that appeared to be a legitimate governmental communique.<\/p>\n

VirusTotal submissions on October 8 showed the malicious file uploaded from multiple locations including Ukraine, India, Italy and Slovakia, suggesting widespread targeting and potential victim interaction with the campaign.<\/p>\n

When they opened the weaponized PDF and clicked on the embedded link, the victims were directed to a domain masquerading as a legitimate Zoom site but hosting a virtual private server (VPS) located in Finland and owned by Russian provider KVMKA.<\/p>\n

This domain led to a fake Cloudflare DDoS protection gateway asking them to click on an \u201cI\u2019m not a robot\u201d reCAPTCHA checkbox.<\/p>\n

The SentinelLabs investigation found that the malicious domain stopped resolving on the same day the attack attempt took place, indicating a single day operation.<\/p>\n<\/p><\/div>\n

\"PhantomCaptcha
PhantomCaptcha infection paths. Source: SentinelOne<\/figcaption><\/figure>\n
\n

Three-Stage Attack Chain<\/strong><\/h2>\n

Clicking the checkbox triggered a popup with instructions in Ukrainian, directing users to<\/p>\n

    \n
  1. Click the \u201cCopy token\u201d button in the popup<\/li>\n
  2. Press Windows + R to open the Run dialog<\/li>\n
  3. Paste and execute the command<\/li>\n<\/ol>\n

    The button ran a function copyToken() containing a PowerShell commandlet (cmdlet) designed to run invisibly. The code downloads and executes the next stage PowerShell script from hxxps:\/\/zoomconference[.]app\/cptch\/${clientId}.<\/p>\n

    \u201cThis social engineering technique is particularly effective because the malicious code is executed by the user themselves, evading endpoint security controls that focus solely on detecting malicious files,\u201d noted the SentinelLabs researchers.<\/p>\n

    The malware delivery campaign that followed was a three-stage attack chain designed to evade detection and establish persistent remote access:<\/p>\n

      \n
    1. The initial payload was a heavily obfuscated PowerShell downloader that fetched and executed the next payload from hxxps:\/\/bsnowcommunications[.]com\/maintenance. The excessive obfuscation served to bypass signature-based defenses and hinder analysis<\/li>\n
    2. The second-stage payload performed system reconnaissance, collecting various user data, such as computer name, username, hardware identifiers and domain information<\/li>\n
    3. This data was XOR-encrypted with a hardcoded key and sent to hxxps:\/\/bsnowcommunications[.]com\/maintenance\/ via HTTP GET requests<\/li>\n
    4. The final payload is a lightweight PowerShell backdoor that connects and repeatedly reconnects to a remote WebSocket server at wss:\/\/bsnowcommunications[.]com:80<\/li>\n<\/ol>\n

      Overlaps with Recent Coldriver Campaigns<\/strong><\/h2>\n

      The SentinelLabs researchers concluded that the PhantomCaptcha campaign reflects \u201ca highly capable adversary, demonstrating extensive operational planning, compartmentalized infrastructure and deliberate exposure control.\u201d<\/p>\n

      \u201cThe six-month period between initial infrastructure registration and attack execution, followed by the swift takedown of user-facing domains while maintaining backend command-and-control, underscores an operator well-versed in both offensive tradecraft and defensive detection evasion,\u201d the researchers wrote.<\/p>\n

      They also identified overlaps between this campaign\u2019s attack chain and recently-reported activity attributed to Coldriver, threat group with reported links to the Russian FSB.<\/p>\n

      Read now: Russian Coldriver Hackers Deploy Malware to Target Western Officials<\/em><\/p>\n<\/p><\/div>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

      Aid groups involved in Ukraine\u2019s war relief efforts and Ukrainian regional government administrations were targeted by a single-day spear phishing attack, a SentinelOne report has revealed. The campaign, dubbed PhantomCaptcha, was conducted on October 8 and delivered a WebSocket remote access Trojan (RAT) hosted on Russian-owned infrastructure that enables arbitrary remote command execution, data exfiltration<\/p>\n","protected":false},"author":2,"featured_media":3370,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-3369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"thumbnail":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68-150x150.jpg",150,150,true],"medium":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"medium_large":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"large":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"1536x1536":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"2048x2048":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"morenews-featured":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"morenews-large":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"morenews-medium":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68.jpg",300,300,false],"crawlomatic_preview_image":["https:\/\/ft365.org\/wp-content\/uploads\/2025\/10\/3369-a517c5fa-3e9e-4ad4-b1e6-90e2207a9b68-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"https:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/3369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=3369"}],"version-history":[{"count":0,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/3369\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/3370"}],"wp:attachment":[{"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=3369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=3369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=3369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}