CVE-2023-38811

Earth Sirrush has run a multi-year spear-phishing espionage campaign against Ukrainian government, defense, border-security, and logistics organizations since at least 2022, with activity and infrastructure linking through July 2026.

Early operations delivered LONEPAGE, SEAGLOW, and OVERJAM via malicious archives, HTA files, and exploitation of CVE-2023-38811. Later activity added compiled C# tools plus credential-theft and reconnaissance capabilities.

The actor used varied delivery and persistence methods including DLL sideloading, VHD containers, scheduled tasks, renamed scheduling utilities, and malicious Notepad++ plugins.

In 2026, CINDERBLOT and BadPaw campaigns used image steganography to conceal payloads and deployed the MeowMeow backdoor. Other chains extracted executable data from images or reconstructed payloads from pixel data using PowerShell.

Researchers linked campaigns through recurring code, developer artifacts, "TelemetryUP" branding, staging conventions, and clustered infrastructure. The proposed connection to Sandworm is characterized as a hypothesis, not evidence of operational control.

Malware families include LONEPAGE, SEAGLOW, OVERJAM, MATCHBOIL, MATCHWOK, DRAGSTARE, ASHVEIN, TelemetryBrowser, AnswerFromPolice, MeowMeow, LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2, and KittyCat.png.

Targeted sectors: border security, defense, government, logistics. Targeted country: Ukraine.

Indicator: order[.]cyberflysystems[.]com

#APT