Compromised Ukrainian Military Cyber Group

Profile narrative

The organisation known as the Compromised Ukrainian Military Cyber Group conducts offensive cyber operations that rely on hijacked Ukrainian military email accounts. Its primary method involves sending phishing messages that contain malicious macro‑laden Excel attachments to targets outside Ukraine. When opened, these attachments deploy the SunSeed malware, a Lua‑based downloader that establishes persistence on the victim system and begins beaconing to command‑and‑control servers. The group’s campaigns are designed to harvest sensitive information from European officials who manage refugee logistics and related humanitarian assistance. By focusing on this sector, the actors seek to collect data on transportation routes, funding mechanisms and population movements.

The activity attributed to this group was first observed on 24 February 2022, coinciding with the onset of the large‑scale Russian invasion of Ukraine. The timing suggests a direct link to the conflict environment and the group’s intent to influence the early phases of the war. The phishing operation targeted officials responsible for coordinating the flow of refugees from Ukraine to European countries. This focus allowed the attackers to gather intelligence that could be used to shape narratives and affect Western support for Ukraine.

Distinguishing the group is its reliance on legitimate‑looking credentials taken from Ukrainian military personnel, which increases the likelihood that recipients trust the incoming messages. The SunSeed payload employed in the campaign is a lightweight Lua‑based downloader capable of retrieving additional malicious modules after initial infection. By establishing persistence and maintaining covert communication with external servers, the malware enables prolonged espionage without immediate detection. The group's tactics align with those previously observed from the threat actor TA445, which operates from Belarus and specializes in disinformation campaigns that exploit refugee movements. This alignment indicates a shared strategic aim of undermining NATO cohesion and amplifying anti‑refugee sentiment.

The organisation is headquartered in Ukraine and operates under the aliases “Compromised Ukrainian Military Cyber Group” and “Ukrainian Military Cyber Attackers.” Its close association with Ukrainian military email accounts points to an origin within the country's defence or security apparatus, although public sources do not disclose a formal parent‑subsidiary structure. The group’s activities are conducted in support of broader hybrid‑warfare objectives that seek to manipulate information flows and influence international perceptions. These characteristics define its role as a cyber‑enabled instrument of state‑linked influence operations.

Incidents

1 incident linked to this organisation.