Full Report
SentinelLABS uncovers a coordinated spearphishing campaign targeting organizations critical to Ukraine's war relief efforts.
Analysis Summary
# Incident Report: PhantomCaptcha Multi-Stage WebSocket RAT Attack on Ukrainian Aid Organizations
## Executive Summary
A sophisticated, coordinated spearphishing campaign targeted NGOs and regional government bodies supporting Ukraine's war relief efforts on October 8th, 2025. Threat actors used emails impersonating the Ukrainian President’s Office to deliver weaponized PDFs that led victims to a fake Cloudflare captcha page designed to execute a clipboard-hijacking command. The final payload was a WebSocket Remote Access Trojan (RAT) hosted briefly on Russian-owned infrastructure, allowing for remote command execution and data exfiltration.
## Incident Details
- **Discovery Date:** Post-attack intelligence shared by Digital Security Lab of Ukraine, investigation launched shortly after October 8th, 2025.
- **Incident Date:** October 8th, 2025 (Single-day infrastructure operation).
- **Affected Organization:** International Committee of the Red Cross (ICRC), UNICEF Ukraine office, Norwegian Refugee Council, Council of Europe’s Register of Damage for Ukraine, and Ukrainian government administrations (Donetsk, Dnipropetrovsk, Poltava, and Mikolaevsk regions).
- **Sector:** Non-Governmental Organizations (NGO/Aid), Government Administration.
- **Geography:** Ukraine.
## Timeline of Events
### Initial Access
- **Date/Time:** October 8th, 2025
- **Vector:** Spearphishing email disguised as a communication from the Ukrainian President’s Office.
- **Details:** Emails contained a weaponized 8-page PDF attachment (SHA-256: `e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3`) with an embedded malicious link.
### Lateral Movement
- The report primarily details initial access and payload delivery, suggesting the RAT was prepared for Command and Control (C2) rather than detailing subsequent internal movement.
- An additional infrastructure pivot revealed a secondary vector targeting Android devices via fake companion applications.
### Data Exfiltration/Impact
- The WebSocket RAT enabled arbitrary remote command execution and data exfiltration from compromised systems.
- The Android payload aimed to collect geolocation, contacts, and media files.
### Detection & Response
- **Detection:** Discovered following intelligence sharing from the Digital Security Lab of Ukraine.
- **Response actions taken:** Investigation initiated, infrastructure analyzed, and IOCs published. The adversaries' command infrastructure was noted to have ceased functioning on the same day it was active.
## Attack Methodology
- **Initial Access:** Spearphishing via weaponized PDF attachment leading to a malicious domain (`zoomconference[.]app`).
- **Persistence:** Implied via the WebSocket RAT payload, facilitating ongoing remote access upon execution.
- **Privilege Escalation:** Not explicitly detailed, but required to deploy the final RAT payloads.
- **Defense Evasion:** Use of embedded links leading to compromised VPS infrastructure masquerading as Cloudflare protection to initiate the secondary stage.
- **Credential Access:** Not explicitly detailed.
- **Discovery:** Not explicitly detailed, but C2 capabilities suggest post-compromise reconnaissance.
- **Lateral Movement:** Not explicitly detailed.
- **Collection:** Data exfiltration capabilities via the RAT, plus collection of geolocation, contacts, and media via the Android variant.
- **Exfiltration:** Enabled by the WebSocket RAT connection to Russian-owned infrastructure.
- **Impact:** Remote command execution potential and data theft.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** Potential theft of organizational and sensitive data from NGOs and government bodies, including personal data from Android devices (contacts, location).
- **Operational:** Potential for disruption to war relief coordination and government administration functions targeted.
- **Reputational:** Negative impact, particularly for the compromised major international NGOs.
## Indicators of Compromise
- **Network indicators (Defanged):**
- **Domains:** `zoomconference[.]app`, `zoomconference[.]click`, `bsnowcommunications[.]com`, `goodhillsenterprise[.]com`, `lapas[.]live`, `princess-mens[.]click`, `princess-mens-club[.]com`.
- **IP Addresses:** `193.233.23[.]81`, `45.15.156[.]24`, `185.142.33[.]131`, `91.149.253[.]99`, `91.149.253[.]134`, `167.17.188[.]244`.
- **File indicators (SHA-256):** (Relevant file hashes omitted for brevity, but included the initial PDF: `e8d0943042e34a37ae8d79aeb4f9a2fa07b4a37955af2b0cc0e232b79c2e72f3`).
- **Behavioral indicators:** Execution of a payload initiated by simulating a 'ClickFix'/'Paste and Run' attack via clipboard commands triggered by a fake reCaptcha challenge.
## Response Actions
- **Containment measures:** The primary infrastructure (`zoomconference[.]app` IP: `193.233.23[.]81`) ceased resolving on the day of the attack, providing a degree of unintended containment.
- **Eradication steps:** Not specified in detail, but would involve removing RAT payloads and potential implanted malware from affected endpoints.
- **Recovery actions:** Not specified in detail, likely involving credential resets and system restoration.
## Lessons Learned
- **Key takeaways:** Adversaries are leveraging complex, multi-stage social engineering techniques (combining weaponized documents with deceptive web challenges like fake Captchas/ClickFix) to bypass security controls. Sophisticated planning was evident, contrasting with the single-day infrastructure lifespan.
- **What could have been done better:** Incident response preparation regarding novel social engineering techniques based on clipboard manipulation needed to be reinforced prior to the attack.
## Recommendations
- Implement enhanced user training focusing specifically on the dangers of unexpected clipboard manipulation prompts (ClickFix/Paste and Run techniques).
- Review and strengthen email gateway filtering to detect weaponized PDFs attempting to serve dynamic content from unexpected domains, even if they masquerade as legitimate verification services.
- Monitor for C2 traffic patterns associated with WebSocket connections originating from end-user browsers to external IPs.
- Audit endpoint security policies regarding the execution of commands via the Windows Run dialog (Win+R).