Sandworm APT Uses Trojanized KMS Tools to Target Ukrainian Users

The Sandworm cyber-espionage group, linked to the Russian military, is targeting Windows users in Ukraine with trojanized Microsoft Key Management Service (KMS) activators and fake Windows updates to deliver malware. These attacks, which likely began in late 2023, disguise malicious payloads as legitimate system tools to trick users into unknowingly installing malware. As part of this campaign, the attackers have deployed a BACKORDER loader to deliver DarkCrystal RAT (DcRAT) designed for data exfiltration and cyber espionage, allowing them to steal sensitive information, monitor user activity, and maintain persistent access to compromised systems.