A newly uncovered hacking group with a string of cyberespionage successes is targeting Ukrainian and pro-Russian targets alike, its motivations uncertain in a conflict that offers little to no middle ground.

See Also: Live Webinar | Education Cybersecurity Best Practices: Devices, Ransomware, Budgets and Resources

Malwarebytes in a Wednesday blog post dubs the threat actor “Red Stinger,” saying the group is the same as the “Bad Magic” threat actor revealed by Kaspersky in March.

Malwarebytes says it traced Red Stinger activities back to 2020, while Kaspersky says it spotted the group in October 2022 – the dates suggesting an investment in stealthy techniques and operational security.

Malwarebytes identified five operations between 2020 and the present, the victims located in central Ukraine and Russian-aligned individuals involved in discredited September 2022 referendums called for by Moscow in Ukrainian territories of Luhansk, Donetsk, Zaporizhzhia and Kherson. Kaspersky identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions.

Depending on the campaign, attackers spotted by Malwarebytes in eastern Ukraine managed to exfiltrate snapshots, USB drives, keyboard strokes, and microphone recordings.

Of two victims located in central Ukraine, one was a military target, although the infection appears to have lasted only a few hours before being spotted.

“As far as we know, attackers managed to exfiltrate on this target several screenshots, microphone recordings and…