FlyingYeti — APT Profile
FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and launch phishing campaigns using malware like COOKBOX. FlyingYeti exploits the WinRAR vulnerability CVE-2023-38831 to infect targets with malicious payloads. Cloudforce One has successfully disrupted their operations and provided recommendations for defense against their phishing campaigns.Also tracked as
UAC-0149, Storm-1837
Tools & malware
- COOKBOX PowerShell backdoor
- CVE-2023-38831 (WinRAR) Exploited vulnerability
Vendor research
- Disrupting FlyingYeti's campaign targeting Ukraine Cloudflare (Cloudforce One)
- Disrupting FlyingYeti's campaign targeting Ukraine Cloudflare (Cloudforce One)