Skip to content

Suspected Russian Hackers Deploy CANFAIL Malware Against Ukraine

alt text

Russian-Linked Malware Loader Ukraine Targeting Espionage

Overview

Security researchers at Google Threat Intelligence identified a previously undocumented threat actor, assessed as likely Russia-linked, that is using a new malware family dubbed CANFAIL in phishing campaigns targeting Ukrainian defense, government, and energy organizations. CANFAIL is a Windows malware loader used as part of a multi-stage infection chain that delivers JavaScript-based loaders disguised as documents to compromise sensitive Ukrainian systems. The operation is part of broader Russian cyber pressure on Ukraine's military and critical infrastructure, focusing on espionage and long-term access rather than immediate destruction, with overlaps in targeting and behavior with known Russian intelligence-aligned actors.

Technical Specifications

Attribute Details
Malware Family CANFAIL (Windows Loader)
Threat Actor Unknown APT (assessed Russia-linked)
Target Countries Ukraine
Primary Targets Defense, government, energy sectors
Attack Vector Phishing emails with malicious archives
Stage 1 Vector JavaScript (.js) files disguised as documents
Stage 2 Delivery PowerShell-based downloader
Exploitation Social engineering; no specific CVE used
Objectives Espionage, credential theft, data exfiltration

Affected Products

  • Ukrainian Defense Sector organizations and personnel
  • Ukrainian Government agencies and ministries
  • Ukrainian Energy/Critical Infrastructure operators
  • Systems running Windows with PowerShell enabled
  • Organizations vulnerable to phishing and social engineering
  • Status: Active targeting campaigns as of February 2026

Technical Details

Malware Characteristics

  • Type: Multi-stage loader malware
  • Platform: Windows (PowerShell-based execution)
  • Delivery: Phishing emails with malicious attachments/links
  • Execution: JavaScript obfuscation with PowerShell staging
  • Persistence: In-memory execution with follow-on implant deployment
  • Evasion: Script-based execution to bypass traditional antivirus

Infection Chain

Stage 1: Initial Phishing Delivery

  • Spear-phishing emails targeting Ukrainian defense, government, energy organizations
  • Emails impersonate official or trusted senders
  • Contain links to cloud storage or attached archives
  • Archive contains JavaScript file with deceptive naming (double extension: report.pdf.js, document.pdf.js)

Stage 2: JavaScript Loader (CANFAIL)

  • Obfuscated JavaScript file executes when victim opens file
  • Launches PowerShell commands from script context
  • Contacts attacker-controlled infrastructure (C2 server)
  • Downloads second-stage payload from remote server
  • Executes payload in memory to avoid disk detection

Stage 3: In-Memory Deployment

  • Second-stage payload operates entirely in memory
  • Can deploy multiple modules based on operator objectives:
    • Credential theft and harvesting
    • Data exfiltration modules
    • Reconnaissance and enumeration tools
    • Persistence mechanisms and backdoors
    • Remote access tools for lateral movement

Attribution & Infrastructure

  • Assessed as Russia-linked based on:
    • Targeting focus on Ukrainian critical infrastructure
    • Behavioral and technical overlaps with known Russian intelligence actors
    • Timing and methods consistent with broader Russian cyber operations
    • No specific CVE exploitation (distinct from simultaneous Office CVE-2026-21509 campaigns)
  • Uses attacker-controlled C2 infrastructure for payload delivery
  • May leverage cloud storage services for initial distribution

Attack Scenario

  1. Reconnaissance & Targeting:

    • Threat actor identifies Ukrainian defense, government, and energy sector organizations
    • Gathers intelligence on specific personnel through open sources
    • Selects key targets in operations, intelligence, or infrastructure planning roles

  2. Phishing Email Crafting:

    • Creates spear-phishing emails impersonating official or trusted senders
    • Crafts emails with context-specific social engineering (organization names, projects, etc.)
    • Includes archive attachment or link to cloud storage containing malicious script

  3. Initial Compromise:

    • Victim receives phishing email and opens attachment or clicks link
    • User extracts archive and executes JavaScript file with deceptive filename
    • CANFAIL loader executes, user unaware of malicious activity

  4. First-Stage Exploitation:

    • JavaScript loader runs obfuscated PowerShell commands
    • PowerShell contacts attacker C2 server to retrieve second-stage payload
    • Payload downloaded and executed entirely in memory
    • Avoids disk-based detection by antivirus and forensic tools

  5. Persistence & Operational Access:

    • Second-stage payload establishes persistence mechanisms
    • Deploys credential theft and data exfiltration modules
    • Enables reconnaissance of compromised system and lateral movement
    • Provides operator with long-term remote access to Ukrainian network

  6. Espionage & Data Collection:

    • Operator tasking of deployed modules based on intelligence objectives
    • Theft of documents, emails, and communications from defense/government systems
    • Potential access to operational data in energy or infrastructure sectors
    • Exfiltration of sensitive information to attacker infrastructure

Impact Assessment

  • Unauthorized access to sensitive defense sector communications and documents
  • Potential theft of military operational plans and strategic intelligence
  • Compromise of government communications and decision-making processes
  • Access to energy sector operational data and infrastructure schematics
  • Espionage against Ukrainian military and government personnel
  • Extended covert access enabling ongoing intelligence collection
  • Multiple in-memory stages bypass traditional detection mechanisms
  • Potential for staged deployment of additional offensive tools
  • Stepping stone for follow-on disruptive or destructive operations
  • Difficult forensic reconstruction due to memory-based execution
  • Intelligence degradation of Ukrainian military and government capabilities
  • Information asymmetry favoring Russian strategic planning
  • Potential for targeted disruption of Ukrainian defense or energy infrastructure
  • Demonstrates sustained Russian cyber pressure on Ukraine
  • Risk of sophisticated coordinated cyber-physical attacks against critical infrastructure

Mitigation Strategies

Email & Attachment Security

  • Suspicious Attachment Blocking: Block or quarantine JavaScript (.js) files and double-extension files (e.g., .pdf.js) at email gateway
  • Archive Restrictions: Disable or restrict email delivery of archives containing scripts
  • Phishing Detection: Deploy advanced email filtering with sender verification and domain authentication (SPF, DKIM, DMARC)
  • User Training: Intensive training for defense, government, and energy sector personnel to distrust unexpected archive attachments or "document" files with script extensions

Windows & PowerShell Hardening

  • Script Host Restrictions: Disable Windows Script Host (wscript.exe, cscript.exe) where not operationally necessary
  • PowerShell Constrained Language Mode: Enforce PowerShell constrained language mode to limit script capabilities
  • PowerShell Logging: Enable and centrally log all PowerShell execution, script blocks, and module loading
  • Execution Policy: Implement strict PowerShell execution policies allowing only signed scripts
  • Process Monitoring: Alert on suspicious PowerShell process spawning and network connections

Application & Execution Controls

  • Application Allowlisting: Implement allow-listing to prevent execution of unapproved interpreters (PowerShell, VBScript, JavaScript runtime scripts)
  • Whitelisting Rules: Restrict file execution to known-safe binaries and scripts only
  • Privilege Restrictions: Run user applications with minimal required privileges to limit infection scope
  • System File Protection: Monitor and protect system directories from modification by non-admin processes

Network Detection & Blocking

  • Outbound Connection Monitoring: Monitor user workstation outbound connections for:
    • PowerShell-initiated network traffic to unknown or suspicious domains
    • Early stage payload download connections
    • C2 communication patterns
  • Block Known Indicators: Maintain list of known CANFAIL and Russian APT C2 infrastructure and block at perimeter
  • DNS Filtering: Block known malicious domains at organizational DNS level
  • Firewall Rules: Implement egress filtering to restrict unnecessary outbound connections

Long-term Defense

  • Security Updates: Maintain current patches and updates for all systems and applications
  • Network Segmentation: Isolate critical defense, government, and energy infrastructure from general networks
  • Credential Management: Implement privileged access management (PAM) and credential vaulting for sensitive accounts
  • Resilience Planning: Develop continuity and recovery plans assuming potential compromise occurs

Resources and References

Incident Reports

Last Updated: February 16, 2026