CERT-UA reported three cyberattacks in March 2025 targeting Ukrainian agencies and infrastructure to steal sensitive data.
The attacks involved the use of compromised accounts to send emails with links leading to VBScript loaders and PowerShell scripts for data exfiltration.
The primary tool used for stealing files, known as WRECKSTEEL, has versions in VBScript and PowerShell.
Any signs of cyberattacks should be reported to CERT-UA for immediate action.