Google Uncovers Russian CANFAIL Malware Attacks Targeting Ukraine

Estimated Reading Time: 6 minutes

Key Takeaways:

  • Discovery of CANFAIL, a new JavaScript-based malware targeting Ukrainian defense and government entities.
  • Increased use of Large Language Models (LLMs) by Russian threat actors for phishing and reconnaissance.
  • Transition toward DNS-based staging and ClickFix social engineering to bypass standard web filters.
  • Formation of the Trusted Tech Alliance to combat AI-driven supply chain threats and ensure transparency.

Table of Contents:

Google’s Threat Intelligence Group (GTIG) recently disclosed the activity of a Russian threat actor utilizing a previously undocumented malware strain designated as CANFAIL. This campaign primarily targets Ukrainian defense, military, government, and energy organizations at both national and regional levels. The scope of the operation has recently expanded to include aerospace manufacturers, entities involved in nuclear and chemical research, and international humanitarian organizations monitoring the conflict. The technical analysis provided by GTIG indicates that Google uncovers Russian CANFAIL malware attacks targeting Ukraine as part of a persistent effort to compromise organizational and personal email accounts through social engineering and technical obfuscation.

The threat actor responsible for CANFAIL has demonstrated an increased reliance on Large Language Models (LLMs) to overcome technical and resource limitations. According to the research findings, the group utilizes LLMs for initial reconnaissance, the generation of phishing lures, and the acquisition of technical guidance for command-and-control (C2) configuration. While the actor is assessed as being less resourced than other primary Russian threat groups, the integration of AI-assisted tools has improved their ability to conduct targeted operations against high-value Ukrainian infrastructure.

Technical Analysis of the CANFAIL Infection Chain

The delivery mechanism for CANFAIL involves phishing emails that impersonate national and local energy organizations. These emails contain Google Drive links that host RAR archives. Inside these archives, the payload is often disguised using double extensions, such as “.pdf.js,” to deceive users into executing the file as a document.

CANFAIL itself is an obfuscated JavaScript-based malware. Its primary function is to initiate a PowerShell script that facilitates the download and execution of a second-stage payload. In most documented cases, this second stage is a memory-only PowerShell dropper. To maintain the illusion of a legitimate file error, the malware displays a fake error message to the user upon execution.

GTIG has further identified technical overlaps between the CANFAIL campaigns and the “PhantomCaptcha” operation disclosed in October 2025. Both campaigns utilize “ClickFix” social engineering, where victims are provided with instructions to resolve a simulated technical issue.

Evolution of ClickFix: DNS-Based Staging and Social Engineering

The effectiveness of ClickFix-style attacks is further substantiated by recent Microsoft Threat Intelligence disclosures regarding DNS-based staging. Attackers have transitioned from traditional web-based delivery to using the nslookup command to retrieve malicious payloads. In this variant, the attacker tricks the user into running a command through the Windows Run dialog.

This command performs a DNS lookup against a hard-coded external DNS server rather than the system’s default resolver. The output of the DNS response is filtered, and the data contained within the “Name:” field is executed as the second-stage payload. This technique utilizes DNS as a lightweight signaling channel, allowing malicious traffic to blend with standard network activity. The subsequent attack chain often involves the download of a ZIP archive from domains such as azwsappdev[.]com, leading to the execution of Python scripts for reconnaissance and the deployment of ModeloRAT.

The shift toward DNS staging represents a tactical move to bypass standard web filters and security controls that monitor HTTP/HTTPS traffic. By abusing procedural trust and providing instructions that mimic legitimate troubleshooting steps, threat actors ensure that the victim performs the infection themselves.

The Ukrainian sector is not the only target of current large-scale operations. Data exfiltration remains a primary objective for various threat actors. Recent reports indicate that Odido suffered a significant data breach exposing 6.2 million customer records. Simultaneously, the extortion group ShinyHunters claimed to have acquired 600,000 records from Canada Goose.

The Canada Goose dataset, released in JSON format, contains customer names, email addresses, phone numbers, shipping addresses, and partial payment card data. ShinyHunters attributes this leak to a breach of a third-party payment processor occurring in August 2025. This incident underscores the necessity for comprehensive supply-chain risk monitoring.

Furthermore, the Land and Agricultural Development Bank of South Africa (Land Bank) recently experienced a ransomware incident on January 12. These incidents illustrate a persistent trend where threat actors utilize information stealers like Lumma Stealer and StealC to gather credentials, which are then used to facilitate larger ransomware deployments.

Industry Response: The Trusted Tech Alliance

In response to the proliferation of AI-assisted attacks, sixteen global technology leaders formed the Trusted Tech Alliance in February 2026. This coalition aims to establish core principles for technology providers:

  • Transparent corporate governance and ethical conduct.
  • Operational transparency and independent assessment.
  • Supply chain and security oversight.
  • An open, cooperative, and resilient digital ecosystem.
  • Respect for the rule of law and data protection.

Operationalizing Cyber Threat Intelligence

For organizations operating in high-risk sectors, maintaining a proactive security posture requires the integration of diverse intelligence feeds. Utilizing a cyber threat intelligence platform allows engineers to correlate indicators of compromise (IOCs) from regional conflicts with broader global trends.

The use of a dark web monitoring service is essential for identifying the exposure of corporate credentials before they are utilized in ClickFix or phishing campaigns. For security operations centers (SOCs), real-time ransomware intelligence and access to a live ransomware API provide the telemetry needed to block C2 infrastructure. Furthermore, telegram threat monitoring can provide early warning of ClickFix lures being distributed through messaging apps.

Technical Takeaways for Engineers

  • Block Common Attack Vectors: Restrict execution of .js and PowerShell scripts from non-standard locations. Watch for double extensions like .pdf.js.
  • Monitor DNS Activity: Implement logging for nslookup commands directed at non-internal DNS resolvers.
  • Implement Credential Protection: Use hardware-based MFA to mitigate the impact of information stealers.
  • Audit Third-Party Access: Conduct regular audits as part of a supply-chain risk monitoring program.

Non-Technical Takeaways for Business Leaders

  • Review Incident Response Protocols: Ensure clear strategies for internal and external communication during a breach.
  • Invest in Compliance: Align security practices with frameworks like those proposed by the Trusted Tech Alliance.
  • Prioritize Security Training: Focus on social engineering awareness, specifically the “ClickFix” technique.

PurpleOps Capability Integration

PurpleOps provides the necessary infrastructure to defend against sophisticated Russian threat actors. Our cyber threat intelligence services offer detailed analysis of emerging malware like CANFAIL. Through our dark web monitoring, we identify leaked credentials in real-time.

Organizations concerned about third-party ecosystems can utilize our supply-chain information security services. In the event of an active threat, our PurpleOps Solutions and teams simulate modern attack vectors. For those facing data encryption threats, our protect ransomware solutions stop attacks at the earliest stage.

To explore how our platform can enhance your operations, visit:

Frequently Asked Questions

What is CANFAIL malware?
CANFAIL is an obfuscated JavaScript-based malware used by Russian actors to initiate PowerShell scripts and deploy memory-only payloads against Ukrainian targets.

How does ClickFix social engineering work?
It tricks users into “fixing” a simulated technical error by running manual commands (like via the Windows Run dialog) that actually initiate a malware infection.

Why are attackers moving to DNS-based staging?
DNS staging allows attackers to bypass traditional web filters that monitor HTTP/HTTPS traffic by using DNS lookups as a signaling channel for malicious payloads.

What is the role of LLMs in these attacks?
Threat actors use Large Language Models to conduct reconnaissance, generate convincing phishing lures, and get technical help with command-and-control setup.