Moldova Warns Public Institutions of Spear-Phishing Campaign Delivering Disguised .bat Payloads
STISC says attackers are mailing .7z and .zip archives from @mail.ru addresses, hiding executable files behind names like "Payment Order" and "Paid Invoices" — and the malware can clean up after itself.
Moldova's national cybersecurity authority has issued a public alert over a spear-phishing campaign aimed squarely at government institutions, with malicious emails arriving from @mail.ru addresses and carrying archives that hide executable files behind the names of ordinary financial paperwork. The warning, published by the Information Technology and Cybersecurity Service (STISC) on Tuesday, 13 October 2026, describes an operation built less on technical sophistication than on the mundane rhythm of office life: invoices, payment orders, and the reflex to open an attachment.
What makes the campaign worth attention beyond Moldova's borders is the payload design. The malware does not simply steal credentials and linger — STISC notes it can terminate its own activity without leaving obvious traces, turning a successful infection into something closer to a ghost than a break-in.
What STISC actually disclosed
The advisory is short and specific. Malicious messages are being sent from a range of email addresses associated with the @mail.ru domain, and they carry archives in .7z or .zip format. Inside those archives sit executable .bat files, renamed to blend into a finance department's inbox: "Ordin de plată" (payment order) and "Facturi achitate" (paid invoices) are the examples STISC gives.
Once a recipient opens one, the file can compromise the host system and enable unauthorised collection of authentication data, cookies, and information tied to active sessions. That last detail is the part security teams should underline. Session material is what lets an attacker step past multi-factor authentication without ever cracking it — steal the cookie, inherit the logged-in session, and the login prompt never appears.
STISC also states that the malicious program can finish its work without leaving evident clues, making the attack difficult for a user to notice. There is no public attribution in the advisory, and no claim about which specific institutions were successfully breached.
Note: STISC's advisory does not name a threat actor, a malware family, or a confirmed victim count. Treat the campaign as confirmed in method and targeting, but unconfirmed in attribution.
Why the .bat file is the whole trick
Batch files are the oldest automation tool on Windows and, for that exact reason, one of the most reliable. A .bat script is plain text, executes natively through the command interpreter, and needs no compiler, no runtime, and no privileged installer. It can call PowerShell, reach out to a remote host, dump browser data, and delete itself on the way out. Nothing about it looks exotic to an endpoint agent that has spent two decades watching command shells do legitimate work.
The archive wrapper adds a second layer of friction. Mail gateways are considerably better at flagging a bare executable attachment than at inspecting the contents of a compressed file, and .7z in particular is less commonly handled by older scanning pipelines than .zip. The naming convention supplies the third layer: a file called "Facturi achitate" is exactly what an accountant expects to see, and expectation is the most effective social engineering tool there is.
This is why the campaign is classified as spear phishing rather than generic phishing. Spear phishing implies research — a plausible sender, a plausible subject, a plausible document for the recipient's actual job. The choice of @mail.ru addresses is itself a signal worth unpacking: it is a free, widely used Russian-language mail provider, which makes the sender address look unremarkable in a region where such correspondence is routine, while giving the operator cheap and disposable infrastructure.
The detection problem STISC is pointing at
The most uncomfortable sentence in the advisory is the one about the malware ending its activity without leaving obvious traces. Security teams tend to build detection around persistence — the scheduled task, the registry key, the service that survives a reboot. An implant that harvests session tokens, exfiltrates them, and then removes itself inverts that model. There is nothing left to find by the time anyone thinks to look.
That shifts the burden of proof from the endpoint to the identity layer. If the credential theft succeeded, the evidence lives in authentication logs, not on the disk: a session that originated from an unusual IP, a login that skipped MFA because the cookie was already valid, a mailbox rule created at three in the morning. Organisations that only monitor endpoints will see nothing. Organisations that correlate identity telemetry with mail telemetry have a chance.
Important: Stolen session cookies can bypass MFA entirely. If you suspect a user opened one of these archives, revoke that user's active sessions and rotate credentials — do not simply reset the password and assume the problem is closed.
What STISC recommends
The advisory closes with a set of practical recommendations directed at public institutions, companies, and citizens alike. They are unglamorous and they work:
- Avoid accessing links and attached files in suspicious messages.
- Check the sender's address carefully, even when the display name looks familiar.
- Protect passwords, authentication codes, and confidential information.
- Treat messages demanding urgent or unusual action with caution.
- Report suspicious emails to information security officers.
Read as a whole, the list is really about one behaviour: verifying before acting. The urgency clause matters most. A genuine payment order does not usually arrive with a deadline measured in minutes, and pressure to act fast is the single most consistent marker of a social engineering attempt.
The reporting gap nobody likes to talk about
The final recommendation — report suspicious emails to security officers — is the one most often skipped, and it is the one that determines whether an incident stays small. Employees frequently stay silent because they are embarrassed, because they assume someone else already reported it, or because they are not sure the message was actually malicious.
For public institutions, that silence has a compounding cost. A single infected workstation is a nuisance. The same archive sent to forty addresses across three agencies, with even a handful of successful executions, becomes an intrusion with a foothold inside government networks. Early reporting converts a potential breach into a blocked email, and it gives the security team the sender addresses and file hashes needed to filter the rest of the wave before it lands.
What this campaign says about the threat landscape
There is a temptation to dismiss a .bat file in a .zip as low-grade tradecraft. That reading misses the point. The campaign is not trying to defeat a hardened target through technical brilliance; it is trying to find the one person in a large organisation who processes invoices for a living and has thirty other things on their mind. Cheap tooling scales, and it works precisely because most of the defensive stack is tuned for sophisticated threats rather than mundane ones.
The regional context sharpens this. Moldova's public sector has been a recurring target of state-adjacent and criminal activity alike, and the country's institutions have invested heavily in cyber resilience in recent years. An advisory like this one is a sign the warning system is functioning — STISC detected the pattern and pushed it out publicly within a day of observing it. That is a healthier position than the alternative, where campaigns of this kind run for weeks before anyone notices.
For any organisation reading this from outside Moldova, the transferable lessons are straightforward. Treat inbound archives as hostile by default and inspect their contents rather than trusting the filename. Log and alert on authentication events, not just endpoint behaviour, because session theft leaves its fingerprints there. Make reporting suspicious mail a frictionless, blame-free action. And rehearse the response to a credential-theft scenario — session revocation, credential rotation, mailbox rule review — before you need it, because the window between execution and exfiltration in a campaign like this one is measured in minutes.
The uncomfortable truth the STISC alert illustrates is that the most effective attacks rarely look like attacks. They look like a payment order from a colleague, in a slightly unusual file format, on a busy Tuesday afternoon. Defences built only for the dramatic version of that scenario will keep missing the ordinary one.