FlyingYeti
Aliases: Storm-1837, Flying Yeti
- Origin
- RU
- Primary motivation
- espionage
- Sophistication
- intermediate
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:15:35
Targeted industries: defense-and-aerospace government-and-public-sector
Targeted regions: country_code:ua
Context
FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and launch phishing campaigns using malware like COOKBOX. FlyingYeti exploits the WinRAR vulnerability CVE-2023-38831 to infect targets with malicious payloads. Cloudforce One has successfully disrupted their operations and provided recommendations for defense against their phishing campaigns.
Exploited vulnerabilities
- CVE-2023-38831 (vulnerability)
Reports & references
- blog.cloudflare.com — Disrupting Flyingyeti Campaign Targeting Ukraine (report)
- Microsoft — Frequent Freeloader Part Ii Russian Actor Secret Blizzard Using Tools Of Other Groups To Attack Ukraine (report)
- cloudflare.com — Disrupting Flyingyetis Campaign Targeting Ukrainev (report)