UAC-0219
UAC-0219 is a cyberespionage threat cluster assessed in the provided reporting as Russia-linked and state-backed, active since at least late 2024 and observed targeting Ukraine in 2025. Reported victims include Ukrainian state administration bodies, local authorities, military-related entities, and critical infrastructure facilities. CERT-UA and SSSCIP reporting describes increasing cyber-espionage activity by UAC-0219 during March 2025 and the first half of 2025. The group is associated with the WRECKSTEEL malware/backdoor, described as PowerShell-based data-stealing malware used to steal data and take screenshots. CERT-UA reported that the UAC-0219 operation included AI-based PowerShell scripts, and SSSCIP stated there is evidence suggesting WRECKSTEEL was developed using AI tools. The broader reporting also places UAC-0219 within a trend of Russian operations shifting toward shorter, theft-focused intrusions and "Steal & Go" activity rather than long-term persistence. Directly mentioned aliases for this actor in the provided content are limited to UAC-0219; no additional aliases or sub-groups are explicitly provided.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UAC-0219 is conducting data theft and surveillance operations against Ukrainian entities, using AI-generated scripts and the WRECKSTEEL malware.
Cyberespionage activity cluster reported by CERT-UA, associated with use of the Wrecksteel backdoor and AI-assisted components (e.g., AI-based PowerShell scripts). The reporting also notes a shift toward shorter intrusion windows, use of information-stealing tooling, and exploitation of zero-click flaws, with operations synchronized with kinetic strikes for disruption.
Conducting malware-based intrusions against Ukrainian state administration bodies and critical infrastructure; used PowerShell data-stealing malware WRECKSTEEL, with indications of AI-assisted development.
Cyberespionage activity attributed with using AI-assisted malware development, specifically AI-generated PowerShell scripting within the Wrecksteel malware, in operations targeting Ukraine.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.