Executive Summary
Between May and September 2026, a Russian-speaking threat actor targeted Ukraine’s state data-exchange infrastructure (UXP/Trembita) by scanning the country's IP space for specific web fingerprints. The operator successfully gained execution on at least two Graylog logging servers using a CommonsBeanutils2 deserialization chain delivered via JNDI injection in the Graylog sessions API.
Technical analysis of the operator's exposed staging server revealed highly targeted reconnaissance against X-Road/UXP security servers and the use of public proof-of-concept exploits for MikroTik RouterOS and FortiGate, alongside original but unsuccessful exploit research against RouterOS SCEP services. While the actor queried millions of documents in Elasticsearch clusters, no large-scale exfiltration was confirmed, suggesting a primary focus on measuring and mapping transactional data-exchange schemas.
This campaign highlights the risk to centralized logging infrastructure which often aggregates sensitive metadata from disparate government services. The actor's ability to filter 9 million IPs down to specific data-exchange participants demonstrates efficient, targeted tradecraft despite a reliance on publicly available exploit chains.