Cloudflare Disrupts Russian Phishing Campaign Targeting Ukraine: FlyingYeti’s COOKBOX Malware Exposed

Hot Take:

Looks like FlyingYeti has taken a page out of the “How to Be a Nuisance” handbook, turning everyday stress into a full-blown cyber nightmare. Just when you thought paying bills was your biggest worry, along comes COOKBOX to steal your data and your sanity!

Key Points:

• FlyingYeti is a Russia-aligned threat actor targeting Ukraine with phishing campaigns.
• The campaign uses anxiety-inducing debt-themed lures to distribute the COOKBOX malware.
• Cloudflare Workers and GitHub were exploited alongside a WinRAR vulnerability (CVE-2023-38831).
• The malware employs dynamic DNS for command-and-control (C2) purposes.
• Other phishing campaigns are targeting European and U.S. financial organizations with various malware.