It then uploads them to command and control servers using several identified IP addresses including 172.86.114.149, 167.88.167.254, and 45.61.157.179, creating a persistent data exfiltration channel that threatens Ukrainian national security. Their analysis revealed the threat has evolved since fall 2024, with early variants using the “IrfanView” graphics editor for creating screenshots, while 2025 versions implement this functionality natively in PowerShell. Ukrainian government agencies and critical infrastructure are facing targeted cyberattacks from threat actor UAC-0219 using the information stealer WRECKSTEEL. The WRECKSTEEL malware represents a significant cyber espionage threat specifically targeting Ukrainian organizations. Organizations should implement security measures to detect suspicious email attachments and monitor outbound connections to the identified command and control infrastructure. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The campaign distributes phishing emails with malicious links to public file services like DropMeFiles and Google Drive, often embedded in official-looking PDF attachments with names suggesting important documents such as employee lists or work schedules. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. CERT-UA researchers noted this campaign in March 2025, documenting at least three significant attacks against Ukrainian government entities. Upon clicking these links, victims unknowingly download a VBScript loader (typically with a .js extension) that subsequently deploys a PowerShell script designed to search for and exfiltrate sensitive files. A sophisticated new variant of the Triada malware family has emerged, targeting Android devices with the capability to intercept and modify outgoing calls.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 03 Apr 2025 16:30:16 +0000