UAC-0194

UAC-0194 is a threat cluster tracked in campaigns targeting Ukrainian entities and assessed with high confidence as having Russian affiliation. The group is associated with exploitation of the Windows URL-file vulnerability CVE-2024-43451, using malicious Internet Shortcut files that can trigger outbound SMB authentication through minimal user interaction and expose NTLM credentials. Reported delivery methods include phishing lures themed around academic certificate renewal and archives containing benign decoy documents alongside malicious shortcut files. Observed activity linked to UAC-0194 includes credential theft via NTLM hash capture, follow-on malware delivery, and persistence. In documented intrusions, exploitation led to retrieval and execution of additional payloads, including SparkRAT, with use of scripting and scheduled-task persistence. Reporting also notes related campaigns using the same vulnerability to deliver information-stealing malware such as RedLine Stealer, although it is not always possible to determine whether all such activity belongs to the same operator or multiple actors reusing the technique. The actor primarily targets organizations in Ukraine, especially government-related entities, and operates in a manner consistent with Russian state-aligned intrusion activity. UAC-0194 is notable for combining social engineering, low-interaction credential-harvesting techniques, malware deployment, and persistence in campaigns against Ukrainian victims.