A new threat actor named FakeTicketer has been identified by F.A.C.C.T. Threat Intelligence, operating since June 2024 with a focus on espionage. The actor targets government officials and sports functionaries using malicious software disguised as tickets for Russian Premier League football matches and rowing competitions. The malware, named Zagrebator, includes a stealer, remote access trojan (RAT), and dropper capable of stealing browser data. FakeTicketer later shifted to using official documents as lures, including school certificates and regulatory acts. The malware components, Zagrebator.Dropper, Zagrebator.RAT, and Zagrebator.Stealer, work together to infiltrate systems, exfiltrate data, and maintain persistence.