Operation-Groundbait.pdf

### Executive summary ESET's "Operation Groundbait" report documents the Prikormka modular surveillance malware used in targeted spear-phishing campaigns primarily against individuals in Ukraine (notably separatists and select high-value targets). The analysis describes the dropper, persistence via DLL load-order hijacking, a downloader/core architecture, multiple data-stealing modules (keystroke logging, screenshots, microphone, Skype, document exfiltration, saved passwords, geolocation), C2 infrastructure and extensive IoCs (domains, IPs, mutexes, SHA-1s), and provides campaign identifiers and attribution indicators pointing to operators likely working from within Ukraine.