HEADRUSH is a rogue Excel plugin used by UNC5976 to deliver an HTML Application (HTA) download. Discovered in April 2026, it is distributed via a fake domain impersonating a Ukrainian research institute, potentially targeting a Ukrainian aerospace and imaging company.