GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain

A newly identified threat actor, dubbed GhostShell, is targeting Ukraine’s UAV ecosystem and defense supply chain with a sophisticated, multi-stage malware cluster featuring custom cryptography, mTLS implant authentication, and disciplined infrastructure—yet with no conclusive attribution beyond the cluster level.