Loading threat actor…
UAC-0050 is a Russia-aligned threat actor tracked primarily for sustained operations against Ukrainian organizations. The group has also been referred to as DaVinci Group and has been labeled Mercenary Akula by BlueVoyant. CERT-UA has described it as a mercenary group associated with Russian law-enforcement structures and linked its activity to the Fire Cells Group brand used for information and psychological operations. Reported activity indicates a mixed mission set spanning cyber-espionage, theft of funds, and influence-oriented operations. UAC-0050 has repeatedly targeted organizations in Ukraine, including government entities, accountants, financial officers, enterprises, and individual entrepreneurs. Reporting also indicates targeting of a European financial institution involved in regional development and reconstruction, suggesting interest in institutions supporting Ukraine. The actor has used spear-phishing and mass phishing with spoofed sender identities and themed lures such as legal documents, tax authority communications, court-related materials, and other business-relevant pretexts. The group commonly relies on commodity remote access trojans and legitimate remote monitoring or administration software to obtain and maintain access. Malware and tooling associated with UAC-0050 include Remcos RAT, NetSupport RAT, Quasar RAT, Venom RAT, Remote Utilities, LiteManager, Remote Manipulator System, TektonIT RMS, and LummaStealer. Campaigns have also been linked to delivery of compressed archives, encrypted or zipped PDFs containing URLs, JavaScript downloaders, LNK and VBS-based infection chains, and remote HTA execution. Proofpoint documented UAC-0050 delivering NetSupport in early 2025, including campaigns using encrypted PDFs with URLs that led to JavaScript-based installation. CERT-UA has also linked the actor to phishing campaigns distributing Remcos RAT and to operations using remote support tools for unauthorized access. Observed tradecraft includes spoofing, credential theft, information theft, persistence through RAT and RMM deployment, and post-compromise abuse of victim systems for financial fraud. CERT-UA reported that during September and October 2024 the actor used unauthorized access to accountants’ computers and remote administration tools to attempt fraudulent payments through remote banking systems at least dozens of times. Stolen funds were reportedly converted to cryptocurrency. The actor’s tactics have been assessed as resembling those of an initial access broker in some campaigns, while its broader activity pattern also supports espionage objectives. UAC-0050 has been associated with repeated phishing against Ukrainian organizations using remote access tooling rather than bespoke malware, and with campaigns that exploit user execution through archives, scripts, and social engineering. Some reporting notes overlap in infrastructure or delivery characteristics with other clusters, but such overlap has not been treated as sufficient to merge attribution absent stronger evidence. Overall, UAC-0050 is best characterized as a Russian mercenary-style threat actor focused on Ukraine, combining espionage, financially motivated intrusion, and influence operations under multiple brands and aliases.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
15 malware families attributed to this actor across reporting.
10 additional families tracked in Mallory.
96 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russia-aligned/associated mercenary cybercrime activity conducting spear-phishing and social engineering to deploy remote access tooling for intelligence collection and/or financial theft; historically focused on Ukrainian entities (notably accountants/financial officers) with apparent expansion to Western European institutions supporting Ukraine’s reconstruction efforts.
Ukraine-focused phishing using compromised email accounts and tax-authority lures to deliver an archive that installs a remote IT/support tool for unauthorized access.
Cluster associated with phishing in Ukraine using compromised email accounts and delivery of a remote IT/support tool for unauthorized access.
Targets Ukraine using email campaigns with encrypted PDF attachments that contain URLs; those URLs typically download a compressed JavaScript file which, when executed, installs the NetSupport RAT payload. Uses encrypted PDFs to hinder content extraction while retaining a consistent PDF object structure that can be fingerprinted for clustering/attribution.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.