CERT-UA has reported a phishing campaign aimed at Ukrainian government organizations. The emails contain PDF attachments that redirect recipients to ZIP archives carrying malicious JavaScript files known as OYSTERFRESH, OYSTERSHUCK, and OYSTERBLUES. Once executed, the malware gathers system information and sends it out through HTTP POST requests, with the option to retrieve a Cobalt Strike component at a later stage. The supporting infrastructure is concealed behind Cloudflare and makes extensive use of .icu domains.
CERT-UA’s analysis identified the malicious JavaScript samples, the decoding methods they rely on, including string reversal, ROT13, and URL decoding, and the registry changes used to maintain persistence. Investigators also documented multiple file artifacts and Windows paths associated with the infection chain. Network analysis linked the activity to Cloudflare-protected .icu hosting infrastructure. The report further notes the possible follow-on delivery of a Cobalt Strike beacon.
Organizations should restrict wscript.exe execution for standard users, limit both PowerShell and JavaScript execution, and monitor the listed registry Run keys for suspicious changes. Web filtering should be used to block .icu domains and, where appropriate, Cloudflare-related IP ranges associated with the campaign. Defenders should also apply least-privilege controls and prevent automatic execution of unknown binaries.
Security teams should create detections for the identified filenames, registry keys, and outbound HTTP POST traffic to the known domains. Hunting should also cover the possible Cobalt Strike payload, including the CSBEACON DLL, and any scheduled task named MicrosoftEdgeUpdateTaskMachine . Endpoint investigations should collect process trees to trace the JavaScript decoding and execution chain.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and produce the exact telemetry expected by the detection logic.
Attack Narrative & Commands: The adversary leverages a signed Windows binary ( mshta.exe ) to run a small JavaScript payload that collects system information and exfiltrates it via an HTTP POST to a malicious “*.icu” domain controlled by the C2 server. This “living‑off‑the‑land” approach avoids raising AV alerts while generating the exact firewall event the rule monitors (POST + “.icu”).
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
