Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FlyingYeti · Unknown · assessed origin Russia · misp-galaxy · refreshed 2026-10-06

FlyingYeti

  • Storm-1837
  • Flying Yeti

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2023-38831

Analyst brief

misp-galaxy

FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and launch phishing campaigns using malware like COOKBOX. FlyingYeti exploits the WinRAR vulnerability CVE-2023-38831 to infect targets with malicious payloads. Cloudforce One has successfully disrupted their operations and provided recommendations for defense against their phishing campaigns.

CVEs cited sources tie to FlyingYeti

none on KEV
  1. CVE-2023-388312026-10-17
    1. “Since April 26, 2024, Cloudforce One has taken measures to prevent FlyingYeti from launching their phishing campaign – a campaign involving the use of Cloudflare Workers and GitHub, as well as exploitation of the WinRAR vulnerability CVE-2023-38831 .”

      cited as exploiting · source: cloudflare.com ↗ · 2026-10-17

    2. “The payload included an exploit for the WinRAR vulnerability CVE-2023-38831, which FlyingYeti will likely continue to use in their phishing campaigns to infect targets with malware.”

      cited as used in a campaign · source: blog.cloudflare.com ↗ · 2026-10-17

    3. “This overlap in names of the benign PDF and the directory allows the actor to exploit the WinRAR vulnerability CVE-2023-38831 .”

      attributed by a report · named nearby · source: blog.cloudflare.com ↗

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.blog.cloudflare.com/disrupting-flyingyeti-campaign-targeting-ukraine
  2. 2.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-par…
  3. 3.cloudflare.com/threat-intelligence/research/report/disrupting-flyingy…

Track FlyingYeti on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.