Cyber Threat Actor: Luhansk People's Republic (LPR)

The threat actor known as Luhansk People's Republic (LPR) has conducted cyber operations primarily against Ukrainian entities, with a documented focus on military targets. Public reporting links this group to the self-proclaimed Luhansk People's Republic, a sub-state entity involved in the conflict in eastern Ukraine. Their activities demonstrate a consistent pattern of cyber espionage aimed at gathering sensitive information from Ukrainian defense organizations. The group's operations align with regional geopolitical tensions, though explicit strategic objectives beyond intelligence collection remain unstated in available sources.

A representative 2018 campaign involved spear phishing emails impersonating a UK defense manufacturer to target Ukrainian military departments. Attackers distributed compressed archives containing legitimate documents alongside malicious LNK files, which executed PowerShell scripts to deploy the custom RATVERMIN backdoor. This malware collected system information, keystrokes, and clipboard contents while enabling remote command execution for activities like audio capture and file deletion. The operation showcased the actor's use of socially engineered initial access vectors and exclusive malware variants not observed in other campaigns. Researchers noted the group's ability to leverage accessible yet effective techniques, highlighting how sub-state actors can develop tailored cyber capabilities for regional espionage operations. The campaign maintained a narrow geographic focus but demonstrated technical adaptations, including file format choices designed to evade detection.