Russia-linked group InedibleOchotense used fake ESET installers in phishing attacks on Ukrainian targets in May 2025. Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks against Ukrainian entities detected in May 2025. The campaign used emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor. “Another […]

A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned. "InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link

introduction of a backdoor dubbed BACKORDER read more about Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine

Eyal Estrin unread, 11:11 PM (25 minutes ago)    to https://securitylabs.datadoghq.com/articles/mut-4831-trojanized-npm-packages-vidar/ Eyal Estrin CISSP, CCSP, CISM, CISA, CDPSE, CCSK Blog: https://security-24-7.com | Books: https://amzn.to/42Xai9A | https://amzn.to/3Sggbtv Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social

A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned. "InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link

Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine | Read more hacking news on The Hacker News cybersecurity news website and learn how to protect against cyberattacks and software vulnerabilities.

Trojanized ESET Installers Drop Kalambur Backdoor in Phishing Attacks on Ukraine A previously unknown threat activity cluster has been observed impersonating Slovak cybersecurity company ESET as part of phishing attacks targeting Ukrainian entities. The campaign, detected in May 2025, is tracked by the security outfit under the moniker InedibleOchotense, describing it as Russia-aligned. "InedibleOchotense sent spear-phishing emails and Signal text messages, containing a link to a trojanized ESET installer, to multiple Ukrainian entities," ESET said in its APT Activity Report Q2 2025–Q3 2025 shared with The Hacker News. InedibleOchotense is assessed to share tactical overlaps with a campaign documented by EclecticIQ that involved the deployment of a backdoor called BACKORDER and by CERT-UA as UAC-0212, which it describes as a sub-cluster within the Sandworm (aka APT44) hacking group. While the email message is written in Ukrainian, ESET said the first line uses a Russian word, likel..

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

A new RAT named SleepyDuck has been found in a malicious extension in the Open VSX marketplace, using an Ethereum smart contract for a resilient command-and-control (C2) mechanism to target developers.

New info-stealer Chessfi targets job seekers via trojanized Node.js apps, stealing credentials and crypto through fake job offers.