Affected Systems

Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer. Campaign primarily targets Ukrainian users but has recorded activity across 32 countries including US, Poland, Germany, Canada, and Netherlands.

Exploitation Status

Active exploitation confirmed. Arctic Wolf Labs observed 557 views, 426 clicks, and 79 successful infections across 32 countries as of analysis date. Compromised sites include Ukrainian hair clinic, scale-model manufacturer, bookseller, psychological facility, tool retailer, and automotive retailer. Attack infrastructure (uasputnik[.]com) registered September 9, 2026. Management panel (Rublevka TDS) actively tracking victim interactions in near-real-time.

Business Impact

Organizations face credential theft from Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Yandex), cryptocurrency wallet compromise (MetaMask, Trust Wallet, OKX, Exodus, Atomic, Electrum, Bitcoin Core, Litecoin Core), and persistent backdoor access. Malware establishes scheduled task persistence, injects malicious browser extensions with native messaging bridge for ongoing C2 communication, and can execute additional payloads (EXE, COM, BAT, CMD, MSI, PowerShell). Social engineering relies on user action (copying and executing clipboard command), making technical controls insufficient without user awareness. Ukrainian organizations at highest risk but global exposure confirmed.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block known malicious domains and IPs: fsputnik[.]com, uasputnik[.]com, 107.175.82[.]242:9000, 193.178.159[.]128:8080 at perimeter firewalls and DNS
  • Hunt for MSI installer execution via msiexec.exe retrieving remote packages from suspicious domains; review Windows Event Log 1033/1034 (MSI installer events) and Sysmon Event ID 1 for msiexec command-line patterns
  • Scan endpoints for Psychedelic artifacts: psychedeliclove.exe, scheduled tasks with unusual names, unauthorized browser extensions, and native messaging host modifications in browser profile directories
  • Deploy user awareness training specifically on ClickFix social engineering: warn against pasting clipboard commands into Windows Run dialog, especially msiexec commands from web pages claiming to be verification checks
  • Monitor outbound connections to C2 endpoints matching patterns /api/v1/ext/passwords, /api/v1/ext/tokens, /api/v1/ext/wallets, /api/v1/checkin, /api/v1/agent/tasks in web proxy and firewall logs

---

# Geopolitical Context

Geopolitical Context

The campaign represents a continuation of cyber operations targeting Ukrainian digital infrastructure amid ongoing regional tensions. The compromise of legitimate Ukrainian business websites—ranging from retail to healthcare—demonstrates a focus on civilian economic sectors rather than traditional government or critical infrastructure targets. The use of Ukrainian-language lures and concentration of victims (446 of 557 recorded views) indicates a geographically focused operation. Russian-language artifacts in the attacker infrastructure and management panel ("РУБЛЁВКА TDS") suggest operators likely based in or aligned with Russian-speaking threat ecosystems, consistent with patterns observed since 2022. The campaign's emphasis on credential theft and cryptocurrency wallets may serve dual purposes: financial gain and potential access-brokering for follow-on operations. The targeting of ordinary Ukrainian businesses reflects a broadening of the threat surface beyond military and government entities.

State Actor Alignment

Attribution remains inconclusive, though technical indicators point toward Russian-speaking operators. The campaign's infrastructure includes Russian-language branding in the "РУБЛЁВКА TDS" (Rublevka TDS) management panel, and implementation artifacts suggest familiarity with Russian-language development environments. However, no direct link to state-sponsored groups has been established by the reporting source. The operation's characteristics—targeting Ukrainian civilian businesses, use of social engineering over sophisticated exploits, and focus on credential theft—are consistent with both cybercriminal activity and lower-tier state-aligned operations. The campaign does not appear to be subject to existing sanctions frameworks, and no government entity has publicly attributed the activity. The geographic victim distribution (primarily Ukraine, with secondary targeting in the U.S., Poland, Germany, Canada, and Netherlands) suggests either opportunistic spread or deliberate targeting of Ukrainian diaspora communities.

Business Impacty pro region

For Ukraine, the campaign underscores persistent threats to civilian digital infrastructure and the challenges of defending a broad attack surface during wartime conditions. Small and medium-sized businesses—lacking enterprise security resources—remain vulnerable to social engineering attacks that bypass technical defenses. The compromise of diverse business sectors (healthcare, retail, publishing) indicates attackers are not limiting operations to strategically significant targets, potentially degrading public trust in domestic web services. For European allies, the secondary targeting of Poland, Germany, and the Netherlands may reflect either collateral spread through business relationships or deliberate reconnaissance of Ukrainian support networks. The campaign's reliance on ClickFix social engineering techniques—increasingly common across multiple threat actors—highlights a broader challenge for Western cybersecurity communities in addressing user-focused attacks that evade traditional perimeter defenses. The cryptocurrency wallet targeting aligns with regional trends in Eastern European cybercrime, where digital asset theft remains a primary monetization vector.

Forecast

If the campaign continues without disruption, additional Ukrainian business websites are likely to be compromised, particularly those with outdated content management systems or insufficient security monitoring. The modular nature of Psychedelic Stealer—with its ability to deploy secondary payloads via multiple execution methods—suggests operators may expand capabilities based on initial access success. If the operation is financially motivated, stolen credentials and cryptocurrency wallets will likely be monetized through underground markets or direct theft. If the campaign has intelligence objectives, harvested credentials may be used for lateral movement into more sensitive networks connected to compromised businesses. The exposure of the "РУБЛЁВКА TDS" management panel may prompt infrastructure changes, though the underlying ClickFix methodology is likely to persist given its effectiveness across multiple campaigns. European cybersecurity agencies may issue advisories on ClickFix techniques if victim counts increase beyond Ukraine. If geopolitical tensions escalate, credential-theft operations like this could serve as precursors to more disruptive attacks, though current evidence does not indicate such intent.