The Computer Emergency Response Team of Ukraine (CERT-UA) released an advisory last week about a new malware campaign targeting Ukranian defense forces. The “SickSync” campaign is named after its tactic of abusing a legitimate file-syncing software – SyncThing – to steal sensitive information from its targets. The attack begins with a phishing email with a “.rar” attachment that extracts a PDF document, an installer “sync.exe”, and BAT script. The BAT script executes the “sync.exe” installer which downloads SyncThing and SPECTR malware. SPECTR malware can grab screenshots of targeted program windows every ten (10) seconds, copy files from local directories and connected USBs, and steal authentication data from browsers and instant messaging applications. The information SPECTR steals is copied to a folder on the victim machine linked to SyncThing, which syncs the data back to the attacker’s systems. The hacking group behind this campaign is thought to be the “Vermin” group, which is tracked by CERT-UA, and attributed by CERT-UA to employees of law enforcement agencies of the occupied Luhansk region. CERT-UA includes a full listing of Indicators of Compromise in their notice. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.