Cisco Talos researchers have recently identified a new malware campaign targeting Ukrainian supporters by offering fraudulent cyber security tools used to “target Russian entities”. The tools, however, deploy info-stealing trojans on the victims’ machines. This campaign was initiated against the recent announcement of the volunteer IT Army recruitment by the Ukrainian government in late February. The researchers specifically detailed the promotion of a fraudulent version of the “Liberator” on Telegram by a group called “disBalancer”. Liberator is a distributed denial-of-service (DDoS) tool that is “a website bomber for use against Russian propaganda outlets”, and there is currently no way to tell the legitimate, yet illegal, tool from the fraudulent version before executing (as neither are digitally signed). The malicious version was observed exfiltrating “a variety of credentials and a large amount of cryptocurrency-related information, including wallets and metamask information, which is commonly associated with non-fungible tokens (NFTs)”. Cisco researchers also revealed that the threat actors behind this campaign are likely existing actors taking advantage of the war between Ukraine and Russia and “have been distributing infostealers since at least November 2021”. CTIX analysts expect additional malware campaigns to be discovered taking advantage of the opportunistic circumstances surrounding the Ukrainian/Russian war as it continues.