Loading threat actor…
UAC-0098 is a threat cluster tracked primarily for targeted campaigns against Ukraine during 2022. The activity has been linked by multiple defenders to the TrickBot and Conti cybercrime ecosystems, and some reporting assesses that the cluster likely included former Conti or TrickBot-associated operators who repurposed established cybercrime tradecraft for operations aligned with Russian interests. The actor has also been described as a former ransomware initial access broker with historical use of IcedID to enable downstream human-operated ransomware intrusions, including access provision associated with Conti and Quantum. UAC-0098 is known for phishing-led initial access using topical and impersonation-based lures, including themes related to mobilization, taxation, law enforcement, Starlink, and wartime events. Delivery mechanisms have included malicious Excel documents with macros, password-protected archives, malicious XLL add-ins, MSI installers, and RTF or DOCX documents exploiting CVE-2022-30190 (Follina). Observed payloads and tooling include IcedID, GzipLoader, Cobalt Strike Beacon, and AnchorMail. Reporting also notes use of attacker-controlled lookalike infrastructure, compromised email accounts, and frequent changes in lures and tooling across campaigns. Victimology centers on Ukrainian organizations and citizens, with repeated targeting of Ukrainian government entities and the hospitality sector, as well as campaigns affecting technology, retail, and humanitarian or non-profit organizations connected to Ukraine. European humanitarian groups were also targeted. The actor’s operations show persistent phishing activity, malware staging and execution, credential theft capability through IcedID, and post-compromise use of Cobalt Strike. Public reporting specifically notes that the actor’s campaigns blurred the line between financially motivated cybercrime and government-aligned targeting in the context of Russia’s war against Ukraine. UAC-0098 has been associated with targeted attacks on Ukrainian critical infrastructure and with broader activity overlapping Russian cybercriminal networks. Separate reporting has also cited possible tooling connections between UAC-0098 and later Russia-aligned activity clusters such as GREYVIBE, further reinforcing its placement within a Russian-speaking cybercrime-adjacent ecosystem.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
144 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as broader ransomware ecosystem context in relation to former Conti members.
Group previously linked to Russian cybercriminal networks and referenced here due to tooling connections with GREYVIBE.
Referenced as an activity cluster with suspected ties to an ISO builder associated with tooling overlap discussed in relation to GREYVIBE.
Activity cluster likely involving former TrickBot members previously observed targeting Ukraine; mentioned as a possible but unconfirmed proximity point for GREYVIBE.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.