Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware

Earth Sirrush is hiding espionage malware inside PNG images and malicious Notepad++ plugins to compromise Ukrainian organizations. The Russia-aligned group has targeted government agencies, defense organizations, border guards, and logistics operators since at least 2022, repeatedly changing its tools to maintain access across the country’s wartime supply networks. The attacks begin with carefully tailored phishing messages, malicious archives, and documents impersonating trusted institutions. Earlier campaigns also exploited the WinRAR vulnerability CVE-2023-38831, while newer operations combine convincing download pages with concealed payloads and software components that appear…