GhostShell Malware Uses mTLS Implant and Telegram Dead

Cybersecuritynews •Tushar Subhra Dutta • June 24, 2026

A newly identified malware cluster known as GhostShell has been found actively targeting Ukraine’s drone operations and its broader defense supply chain. The campaign uses a sophisticated combination of techniques, including a mutual TLS implant and a Telegram-based dead-drop resolver, to quietly establish persistence inside targeted networks. The threat actor behind this operation has been […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

GhostShell Malware Targets Ukraine's UAV and Defense Supply Chain The GhostShell malware cluster is actively targeting Ukraine’s UAV operations and defense supply chain. Utilizing advanced techniques such as mTLS-authenticated implants and Telegram-based loaders, the attackers gain initial access through decoy documents impersonating a Ukrainian drone company. The campaign employs a multi-stage intrusion chain involving VBS scripts and custom malware like 122.exe. The operation has been linked to Vidar infostealer activity within the same infrastructure. Security teams are advised to implement strict mTLS certificate validation and monitor for unauthorized client certificate use. Immediate isolation of affected systems and memory forensics are recommended to identify in-memory implants. Organizations should also review network logs for traffic to specific domains associated with the attack. 2 sources 79

GhostShell Malware Uses mTLS Implant and Telegram Dead

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)