On 8 April 2025, a Russian hacker group known as UAC-0050 reportedly attempted to carry out a cyber attack on the Institute of Mass Information (IMI), a Ukrainian press freedom group. According to IMI, the group received several emails which were in fact phishing attempts: hackers would have sent several messages in the name of unspecified “accountants”, who asked recipients at IMI to download .zip folders containing malicious software. Ukrainian cyber security experts contacted by IMI explained that if the folders had been downloaded, the devices through which this was done would have been infected with spyware enabling hacker access to cameras, microphones and stored documents, among other elements.
“Russians are closely monitoring and looking for vulnerabilities to gain access to journalists and activists,” said Yana Mashkova, a media expert working for IMI, in a comment on the incident. “If before they used to write [messages] in Russian or in a mix of languages, now they are improving the messages [they send] in Ukrainian and are adding details to create the impression that the letter is real. However, all these letters [still] have the same style: a call for an urgent [reaction] and the presence of a ‘document’ that needs to be downloaded from another service. They hope that Ukrainians will download the document in a hurry, then Russians will gain access to the account or [will be able to] remotely monitor [their] devices,” said Yana Mashkova, a media expert at the Institute of Mass Information.