Executive summary
In August 2026, Digital Security Lab Ukraine (DSLU) investigated an attack on a representative of a Ukrainian civil society organization. The attackers used an increasingly common tactic for delivering malicious code.
First, a typical email arrived offering collaboration on an engaging topic: no links, attachments, or anything that could trigger security systems. Only if the victim replied to the message – the attackers would send a message containing a link to an archive containing a malicious file.
The file in the archive appeared to be a PDF document, but was actually an LNK trap shortcut. When double-clicked, it displayed a normal document to the victim – but in the background, malicious code was downloaded to the computer and silently executed, persisted in the system, collected and transmitted data to the attackers. Later in this report, we break down this chain of events step by step.
Benign first-contact
The message was sent from the address “[email protected]” signed by name associated with a well-known ukrainian expert, author, and analyst on international relations, with a particular focus on the Asia-Pacific region.. Subject: “Proposal for analytical cooperation and the exchange of materials regarding security challenges and international advocacy.”
Inside, there’s nothing but text. From the perspective of any filtering system, this is a perfectly clean email from a Google user, and there’s no reason to block it.
This email wasn’t written using a mass-mailing template but was tailored to a specific person. The authors address the recipient by name and mention specific areas of work, partner organizations, and so on. The email read like a message from a knowledgeable colleague, not like spam.
*Note. This is not an isolated incident. We are seeing an increasing number of attacks in which emails are sent through genuine Gmail accounts. The scheme has become standard: create a free email account, enter the first and last name of a real person – someone the potential victims know personally or at least well-known in the field, and start a conversation.
The move they waited for
Only after the potential victim replied to the email, expressing interest in collaborating, the attackers sent a phishing message in response.
Inside the archive was a file named “Natalia’s_Analytical_Report.pdf.lnk”. In Windows, file extensions are typically hidden, so in the file list it appeared as “Natalia’s_Analytical_Report.pdf” – and had a PDF document icon. In reality, it was a shortcut LNK containing a hidden script.
After double-clicking the shortcut
After launching the decoy shortcut (LNK), the following will happen:
- A deceptive PDF document “aa.pdf” is downloaded and opened. This is a genuine document containing the event program, which the attackers downloaded or stole from somewhere. The PDF itself contains no malicious content.
- At the same time, a script from the LNK file downloads “first.ini” file content from adversaries GitLab repo. It saves a malicious script in “applee.vbe” file and executes in hidden mode.
Deobfuscated “first.ini” - That script, in turn, loads the next piece of code from the same GitLab repo – “help.ini” and executes it directly in the computer’s RAM (LOLBin). It collects data about the system and files, encodes it, and sends the information to a private GitHub repository controlled by the attackers.
- Persistence is ensured by a task created in the Windows Task Scheduler, which runs every 15 minutes.
Details worth noting
After infection, a scheduled task appears on the computer – a built-in Windows feature that runs programs on a schedule. The task has a name that mimics a Google update “GoogleUpdateTaskMachineA…” and runs every 15 minutes. The settings are configured so that it doesn’t skip even when the laptop is running on battery power.
Here’s what it looks like in the code:
Deobfuscated “help.ini” code with explanations Every 15 minutes, the computer connects to the attackers’ account to check for new instructions. A key detail is that it accesses a folder named after that specific computer. The attackers can choose which machines to target. They see a list of infected machines and can send individual tasks to any that interest them.
We have been monitoring the attackers’ repositories for a few days and can say with confidence that they are constantly improving their tools. This means that infection is not the end of the attack, but rather its beginning. It also means that the payload hashes are constantly changing, which makes detection more difficult. The first stage simply gathers information to sort the victims. What exactly happens next is up to the operator on the other end, depending on the specific computer and its owner.
Attackers regularly make changes to the code hosted on the GitHub repo Exfiltration
In the first stage, two sets of data are collected:
- A complete “systeminfo” profile – Windows version, installed updates, hardware configuration, network settings, membership in a corporate domain, and more.
- A list of the contents of the “Downloads” folder, including subfolders up to two levels deep – that is, the names of all documents, archives, and files that the user has recently downloaded.
In the “help.ini” code, this literally consists of two commands:
The collected data is packaged and sent to GitHub, to a folder named after the victim’s computer, with files labeled with the date and time. After being sent, the temporary files are deleted. The transfer takes place via the standard GitHub API.
An analysis of the broader attacker infrastructure revealed that, on the compromised machines, the toolkit is capable of doing much more: collecting data from messaging apps (including Telegram) and establishing full remote access to the computer (AnyDesk RMM).
Logs from the attackers’ GitHub repo show compromised computers list and additional payloads We also discovered other PDF decoys, versions of scripts, and logs containing the names of 45+ compromised computers.
Indicators of Compromise
Email sender [email protected] URL from mail hxxps://codeberg[.]org/tomas-89/myaccount/raw/branch/main/Аналітичний_звіт_Наталії.zip Codeberg nickname tomas-89 GitLab nickname kickball12 GitHub nickname bormanye GitHub commit account [email protected] Аналітичний_звіт_Наталії.zip 5628430574d3abb66aef8941bc8aee7d6f2c7b3993eb8fcd4d4fff3f2c315e94 Аналітичний_звіт_Наталії.pdf.lnk a865ed5002f2dfa61be27c58448a61f05259167938aa6eecc7c259693dba7580 first.ini 3efb40b7061ea419ac03f42be49a7a8e0f6d2831571d5d14e76137dbcbf4cbbb help.ini 142bf55220fc1bf0f612ba03986768b663d819b14f49af004329342bd64f319f aaa.pdf cbe68d8dea02675410181af1b769aefa7ec5cd9eefda6555d920dd9e25e6d9b5 URL first stage payload hxxps://gitlab[.]com/kickball12/bahubali/-/raw/main/first.ini URL second stage payload hxxps://gitlab[.]com/kickball12/bahubali/-/raw/main/help.ini Decoy PDF document hxxps://gitlab[.]com/kickball12/bahubali/-/raw/main/aaa.pdf Payload save path C:\Users\Public\Music\apple.vbe C:\Users\Public\Music\aa.pdf Windows Task name GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} Related IOCs:
Another version payloads hxxps://github[.]com/bormanye/chseirfkks/raw/refs/heads/main/first.ini hxxps://github[.]com/bormanye/chseirfkks/raw/refs/heads/main/help.ini hxxps://github[.]com/bormanye/chseirfkks/raw/refs/heads/main/second.ini cs.pdf b876690798b14de8015eb7fd4eac7c3080f5c062376a082a86d81e6dccef0537 kcs.pdf d37ba2d919be0255f2950ec596ad3107f4f3938bb53b458af06aea8991b665f6 first.ini 49a3d8e210e744fcd7d9fa1d3fbc78ca9b632c23f8a306a2f917df0bc035ee1d help.ini a906cea68e328b76195b22a60f61df1e8ba1293567944d150fc984884035b56d second.ini 51bc09ddb8652c8186b096114100445919ba3ad73e6d3d5975661ec8d1e09ae1 Payload save path C:\Users\Public\Music\weff.vbe KCSCON_2026_Official_Invitation.pdf.lnk 0b3c31c851f3c1c0fa38f3719de5e600d89a817a3186cbc09d7d5315e1cbf561 Official Invitation Letter&Detailed Concept Note.pdf.lnk 5b65ba3828c528c24e4d0d5a30eb645bc4f7d2266183d6b0bef0e47673444ae3 Peace and International Security in the Contemporary Era.zip 1b9f686134f23408d04759fac16730e325ad934d66ace57a71e845a839b4382d 具体的なインタビュー資料.pdf.lnk 8f18b20ef1e9067afa9f9bcba7cd9141d7f5206eead1ab3691352879ef231dbd Detailed Interview Data.zip bb4810105b7fd9b9f03841f693741f808b81fcce5d40c41473cd21811f8e99a8 http://raw.githubusercontent.com/cryseuk/ayukiko/refs/heads/main/apple.ini apple.ini 81a7d91d1d3bab0fe882108f024bdffd128474fcc4829800a61acd4b1607d214 https://raw.githubusercontent.com/shantez441/EDGTy/refs/heads/main/wiask.ini wiask.ini 2c9db137905868ff05f96f7320ef3de1b772bdc2450d219e4d36de1d0e26751d
