ESET researchers observed tens of thousands of machines infected with AsyncRAT and its variants over the past year. The open-source malware is a popular tool among cybercriminals.

The campaign traces back at least to early 2022, coinciding with the start of Russia’s full-scale invasion of Ukraine.

Beijing's hackers are also using an open-source VPN tool for persistence.

Targets of the operation were given phony coding challenges that delivered a range of malware including a previously-unseen backdoor.

The work has been carried out by a newly identified group dubbed "MustachedBouncer," according to researchers with ESET.

Researches believe the destructive malware is the work of Sandworm, a Russian military unit suspected in a series of Ukrainian cyberattacks.

Active since 2020, the cyberespionage group has targeted a range or mostly Asian public and private entities.

Dragos says the group behind the tools has a "breadth of knowledge" that's "beyond" any previously witnessed.

Russian losses near Kyiv and a looming onslaught in eastern Ukraine may be a factor in the attack, a Ukrainian official said.

Ukraine's Victor Zhora said the so-called IT Army has done "useful" things, and he offered information about the "CaddyWiper" incident.