Russia-linked APT InedibleOchotense impersonates ESET to deploy backdoor on Ukrainian systems

Russia-linked group InedibleOchotense used fake ESET installers in phishing attacks on Ukrainian targets in May 2025.

Russia-linked group InedibleOchotense used trojanized ESET installers in phishing attacks against Ukrainian entities detected in May 2025. The campaign used emails and Signal messages to deliver trojanized ESET installers that installed both legitimate software and the Kalambur backdoor.

“Another Russia-aligned threat actor, InedibleOchotense, conducted a spearphishing campaign impersonating ESET. This campaign involved emails and Signal messages delivering a trojanized ESET installer that leads to the download of a legitimate ESET product along with the Kalambur backdoor.” reads the report published by ESET.

The Russia-aligned group sent phishing emails and Signal messages containing links to trojanized ESET installers hosted on fake domains. The campaign shares tactics with activity previously attributed to UAC-0212 and the BACKORDER downloader.

The researchers noticed that messages contained minor language errors, suggesting poor translation from Russian to Ukrainian.

The phishing email impersonating ESET warned users of suspicious activity linked to their email and urged them to download “official threat removal software.” The link directed victims to fake ESET domains (e.g., esetsmart[.]com, esetscanner[.]com, esetremover[.]com) hosting a ZIP file with a legitimate ESET AV Remover and a Kalambur backdoor.

The InedibleOchotense group exploited ESET’s strong reputation in Ukraine to trick users into installing malware.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)