A sophisticated Russian-aligned threat actor known as Hive0156 has intensified its cyber espionage campaigns against Ukrainian government and military organizations, deploying the notorious Remcos Remote Access Trojan through carefully crafted social engineering attacks. The encrypted PNG file, randomly named in each campaign, contains multiple HijackLoader modules including AVDATA for security software detection, ESAL for payload execution, and rshell for memory management. The group maintains geofencing restrictions limiting infections to Ukrainian IP addresses while filtering connections based on expected user-agent strings, demonstrating precise targeting capabilities that maximize operational security while minimizing exposure to security researchers. The threat actor’s operations represent a significant escalation in cyber warfare tactics, with attackers leveraging highly relevant-themed decoy documents to entice victims within Ukraine’s defense establishment. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The group has demonstrated remarkable persistence in targeting Ukraine’s defense infrastructure throughout 2025, utilizing weaponized Microsoft LNK files and PowerShell scripts as primary attack vectors. These malicious campaigns exploit the ongoing conflict by incorporating themes such as battalion readiness checks, wartime casualties, and operational staff distribution to maximize the likelihood of successful infiltration. IBM analysts identified that Hive0156’s Tools, Tactics, and Procedures strongly overlap with CERT-UA’s UAC-0184 actor, suggesting coordinated efforts within Russia’s cyber operations framework. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These modules work collectively to inject the final Remcos payload into a remote process, establishing covert communication channels with the attackers’ command-and-control servers spanning multiple geographic locations. The group has evolved its targeting strategy from exclusively military personnel to a broader audience, incorporating themes related to petitions and official correspondence in recent campaigns. The group’s infection methodology demonstrates advanced technical sophistication through its deployment of HijackLoader, also known as IDAT Loader, which serves as the primary delivery mechanism for Remcos RAT. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Fri, 25 Jul 2025 07:05:21 +0000