: Inside the archive, there is often a double-extension file (e.g., RUS-129_Report.pdf.exe ) or a malicious LNK (shortcut) file. Payload Delivery :
: The malware often creates a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or schedules a task to ensure it survives system reboots. RUS-129.7z
Based on current threat intelligence and technical indicators, is a malicious compressed archive identified as part of targeted phishing or cyber-espionage campaigns, often associated with geopolitical themes involving Russia and Eastern Europe. Technical Summary File Name : RUS-129.7z Extension : .7z (7-Zip compressed archive) Primary Threat Category : Trojan / Stealer / Downloader : Inside the archive, there is often a
The "RUS-129" naming convention is frequently used in campaigns targeting organizations or individuals monitoring Russian military movements or diplomatic relations. These archives are often "spoofed" to look like official correspondence from the Ministry of Defense or related state entities. Technical Summary File Name : RUS-129
: Consider blocking .7z and .rar attachments from external sources if they are not standard for your business operations.