RU APT targeting Energy Infrastructure (Unknown unknowns, part 3) Archived: 2026-04-05 13:57:52 UTC Attacks on the Energy infrastructure raise an eyebrow, whether they're cyber-physical in nature, or purely espionage. For that reason, when StrikeReady Labs identified a targeted spear phishing campaign tailored for the Gas Infrastructure Europe (GIE) association, we analyzed the content immediately after submission to Virustotal on October 18th. Further pivots showed direct targeting, and in some cases compromises, of: Ukraine’s electrical transmission infrastructure A Slovakian gas storage company An American energy brokerage A Ukrainian international investment organization A Ukrainian financial auditing organization And other attendees of the aforementioned natural gas conference in Germany These targets all have access to sensitive data that would be of interest to a government. This particular campaign has been ongoing since early October '24. The number of energy-specific targets is highly unusual for the majority of APT threat actors, and the sustained targeting and re-targeting of Ukraine has only seen by Russia-nexus actors. The timing of phishing natural gas organizations just before the winter is also difficult to ignore. TLDR for threat hunters: Look across your logging infrastructure for executions of mshta with an external payload, and you too could find this https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/ Page 1 of 8 Figure 1: Initial tweet from Oct 18 '24 We performed initial triage, as we do daily on our https://bsky.app/profile/strikereadylabs.com and https://x.com/strikereadylabs accounts. You can follow along with our process in Part 1 and Part 2 of this series. However, at CYBERWARCON last week, an unnamed analyst flagged us down, and chuckled, “hey, nice Sandworm tweet”, which made us take a second look at this cluster. This post won’t focus on the Sandworm specific attribution, as we do not have the telemetry to independently make that attribution, but rather how we discovered it, and how you could pivot to find the same types of threats in your own network. Networking IRL FTW. A member of the infosec community on linkedin recently posited a question, “What’s your favorite network hunt?”. One of our analysts responded If I only had one, "mshta.exe http" . And that’s literally how we found this thread to pull on. There are very few new files you’ll come across that execute mshta to run remote content, and you can put a pair of eyeballs onto each and every one. It won’t take more than a couple seconds to triage, provided you’re logging the appropriate telemetry, and it works equally well against crimeware or APT. As an added bonus, it will only flag on positive detections where you have an “action item”, due to the nature of it being an intermediary stage after the attacker has execution ability on your endpoint, but generally not a full payload. So all that is to say, it’s a great mechanism to find high fidelity hits. Hopefully you’ll forgive the wizard behind the curtain from not having a more exciting answer as to how we found one of the more advanced threat groups out there. https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/ Page 2 of 8 Figure 2: execution/hunt paths – credit to the folks at d2lang 1. Pivoting on win11signal in the LNK metadata gives us a second lnk, and a pivot on the hosting domain gives us a third Lnk Assessed Name Hosting domain b8d97d29e99e1f96e06836468db56855dc09305e3ed663c720fe700ea4bf6e73 GIE Annual Conference 2024 in Munich Voting Result Event.pdf.lnk adobeprotectcheck.com 806b5269e7aa9c2c82ce247b30a3e92a4f7285b21e2bcf54c8ffad86bd92ea68 Заява про витік газу ТОВ ОПЕРАТОР ГТС УКРАЇНИ.pdf.lnk (Gas leak statement LLC GTS OPERATOR UKRAINE.pdf.lnk) adobeprotectcheck.com https://strikeready.com/blog/ru-apt-targeting-energy-infrastructure-unknown-unknowns-part-3/ Page 3 of 8 zayavka.lnk Wireshark Agency.pdf.lnk adobeprotectcheck.com Figure 3: additional LNK from adobeprotectcheck It’s noteworthy that these are WebDAV servers. There are a small number of groups who phish with LNKs hosted on WebDAV servers, particularly that use the “Downloads” directory. This attacker may be attempting to blend in with the broader criminal group. We will use this fact later on to find more infra. 2. The first stage payload executed by MSHTA (shell completion of msh*e below) is not a standalone HTA at all, but a bunch of EXEs concat’d together with