Loading threat actor…
UAC-0245 is a threat cluster tracked by CERT-UA for targeted cyber-espionage operations against Ukrainian organizations. The group has been observed targeting members of the Ukrainian Officers Union and other Ukrainian entities, with reporting also indicating interest in organizations holding sensitive data, including government and telecommunications targets. The activity is consistent with long-term intelligence collection rather than disruptive or criminal monetization objectives. UAC-0245 is known for using malicious Microsoft Excel XLL add-ins as the initial execution mechanism, including delivery through Signal using lures themed around border crossings or detention-related documents. In observed intrusions, the XLL-based loader establishes persistence through multiple native Windows mechanisms, including Registry Run keys, the Startup folder, and scheduled tasks, then launches Excel in hidden mode to load a secondary add-in and extract CABINETRAT shellcode from an embedded carrier file. CABINETRAT is a C-based backdoor used by UAC-0245 to maintain covert access, conduct host reconnaissance, capture screenshots, execute commands, enumerate files and directories, transfer data, and exfiltrate information. The malware has also been associated with anti-analysis and defense-evasion measures, including virtualization and debugger checks, environment validation, and manipulation of Excel resiliency settings to prevent malicious add-ins from remaining disabled. The group’s tradecraft emphasizes stealth, persistence, and blending into normal Windows and Office behavior rather than relying on noisy or destructive techniques. CERT-UA assigned UAC-0245 as a distinct identifier because the observed tactics, techniques, and procedures were considered novel enough to separate this activity from previously tracked XLL-based operations against Ukraine.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage campaigns against Ukrainian organizations and mid-to-large enterprises holding sensitive data, including government and telecom sectors, using CABINETRAT for quiet, long-term access, surveillance, reconnaissance, and file exfiltration.
Attributed 2025 targeted campaign against Ukrainian organizations using CABINETRAT delivered via malicious Excel XLL files (disguised as border-related documents) distributed over Signal to gain stealthy access and conduct ongoing surveillance.
UAC-0245 is targeting Ukrainian organizations using the CABINETRAT backdoor for cyberattacks.
CERT-UA tracked cluster conducting targeted cyberattacks (against SOU per the title) using the CABINETRAT backdoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.