Google Links Russian Actor to CANFAIL Malware Targeting Ukrainian Organizations

Google’s Threat Intelligence Group (GTIG) has identified a new threat actor linked to attacks against Ukrainian organizations using malware named CANFAIL. This group is believed to have connections to Russian intelligence services and has targeted various sectors, including defense, military, government, and energy organizations within Ukraine. Additionally, they have shown interest in aerospace, manufacturing, and international humanitarian organizations.

Despite being less sophisticated than other Russian threat groups, this actor has begun utilizing large language models (LLMs) to enhance their operations. They employ these models for reconnaissance, crafting social engineering lures, and managing post-compromise activities.

The threat actor has conducted phishing campaigns impersonating legitimate Ukrainian energy organizations to gain unauthorized access to email accounts. They have also masqueraded as a Romanian energy company and targeted organizations in Moldova.

To facilitate their operations, the group generates tailored email address lists based on their research. Their attack chains often include LLM-generated lures and links to Google Drive that lead to a RAR archive containing the CANFAIL malware.

CANFAIL is an obfuscated JavaScript malware that executes a PowerShell script to download a memory-only PowerShell dropper while displaying a fake error message to the victim. This tactic aims to evade detection and successfully compromise systems.

Additionally, the threat actor is associated with a campaign called PhantomCaptcha, which was disclosed in October 2025. This campaign targeted organizations involved in Ukraine’s war relief efforts through phishing emails that directed recipients to fake pages with instructions to activate the infection sequence.

Understanding the Threat Landscape

The emergence of this threat actor highlights the evolving tactics used by cybercriminals, particularly in conflict zones. Their use of LLMs indicates a shift towards more sophisticated methods, even among less resourceful groups.

Organizations should remain vigilant against phishing attempts and ensure robust email security measures are in place to mitigate risks associated with such attacks.