Loading threat actor…
UAC-0226 is a Russia-linked cyber-espionage threat cluster active against Ukraine since at least February 2025. The group has targeted Ukrainian military innovation organizations, armed forces units, law enforcement entities, regional and state government bodies, and defense-related personnel, including organizations near Ukraine’s eastern border. Its operations are associated with the GIFTEDCROOK stealer and, in some campaigns, a reverse-shell capability. UAC-0226 primarily gains initial access through phishing emails carrying malicious attachments. Observed lures have included military and administrative themes such as reconnaissance, drone production, landmine clearance, fines, and compensation matters. Earlier campaigns used macro-enabled Excel attachments containing embedded payloads that were decoded and executed on victim systems, while later activity used weaponized WinRAR archives that abused path traversal and Alternate Data Streams to drop a decoy document, establish Startup-folder persistence via a shortcut, and launch an obfuscated PowerShell loader. The group’s tooling shows a consistent emphasis on stealth and in-memory execution. Observed tradecraft includes obfuscated PowerShell, additive payload encoding, reflective loading of a custom headerless PE image, dynamic API resolution through native NT interfaces, and execution telemetry sent separately from stolen data. GIFTEDCROOK is designed for browser and file theft, including extraction of credentials, cookies, browsing data, and session material from Chromium-based browsers and Firefox, as well as collection of documents, archives, VPN profiles, KeePass databases, Java KeyStores, and email files. Stolen data is staged into archives and exfiltrated through attacker-controlled channels, including Telegram in earlier reporting. Known aliases and associated tooling include GIFTEDCROOK. The cluster is assessed as espionage-motivated and aligned with broader Russian operations targeting Ukrainian defense, government, and law-enforcement sectors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
25 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a credential and document theft campaign using booby-trapped WinRAR archives, Alternate Data Streams, obfuscated PowerShell, and reflective PE loading to deliver the GIFTEDCROOK stealer against Ukrainian military-related targets.
Conducting credential and information theft campaigns using weaponized WinRAR archives, LNK-based execution, obfuscated PowerShell loaders, additive payload encoding, reflective in-memory loading, and browser/document/VPN/KeePass theft against Ukrainian military-themed targets.
Conducting stealer campaigns using weaponized WinRAR archives with Ukrainian military-themed decoys, LNK-based execution, obfuscated PowerShell loaders, additive payload encoding, reflective in-memory loading, persistence via Startup folder placement, and theft of browser data, documents, VPN configs, KeePass databases, and other sensitive files.
UAC-0226 targets Ukrainian defense, government, and law enforcement with malware-laden email attachments, using GIFTEDCROOK to steal browser data and exfiltrate it via Telegram.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.