Cloudflare Disrupts Russian Phishing Campaign Targeting Ukraine: FlyingYeti’s COOKBOX Malware Exposed
Cloudflare has disrupted a month-long phishing campaign by Russia-aligned FlyingYeti, which targeted Ukraine using debt-themed lures. The campaign exploited WinRAR vulnerabilities to spread COOKBOX malware.
Hot Take:
Looks like FlyingYeti has taken a page out of the “How to Be a Nuisance” handbook, turning everyday stress into a full-blown cyber nightmare. Just when you thought paying bills was your biggest worry, along comes COOKBOX to steal your data and your sanity!
Key Points:
- FlyingYeti is a Russia-aligned threat actor targeting Ukraine with phishing campaigns.
- The campaign uses anxiety-inducing debt-themed lures to distribute the COOKBOX malware.
- Cloudflare Workers and GitHub were exploited alongside a WinRAR vulnerability (CVE-2023-38831).
- The malware employs dynamic DNS for command-and-control (C2) purposes.
- Other phishing campaigns are targeting European and U.S. financial organizations with various malware.
Already a member? Log in here