Loading threat actor…
UAC-0180 is a Russian-attributed threat group focused on gaining unauthorized access to Ukrainian military and defense-related targets, particularly defense enterprises and personnel associated with the Defense Forces of Ukraine. The group has been identified as part of a broader cluster of Russian cyber activity that shifted toward highly targeted intelligence collection against Ukraine’s defense sector in 2024. UAC-0180 commonly relies on phishing-based initial access, including lures themed around defense procurement and other military-relevant subjects. Observed infection chains use malicious documents and links to deliver multi-stage malware and remote access tooling. The group has deployed a diverse malware arsenal implemented across multiple programming languages, including ACROBAIT written in C, ROSEBLOOM and ROSETHORN written in Rust, GLUEEGG written in Go, and DROPCLUE written in Lua. In documented operations, GLUEEGG decrypts and launches DROPCLUE, which opens decoy content while delivering additional payloads that ultimately install legitimate remote management software for covert remote access. The actor’s tradecraft includes social engineering, staged loaders, use of decoy documents, and abuse of legitimate remote administration tools to maintain access and support follow-on collection. Reported activity indicates a sustained emphasis on espionage-oriented access to Windows systems used by Ukrainian defense organizations and military personnel rather than disruptive or destructive effects. UAC-0180 is also referenced as UAC-0180 (RomCom).
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-attributed threat group conducting cyber operations targeting Ukraine's military and defense sectors, with a focus on intelligence gathering.
Spear-phishing campaign against Ukrainian defense enterprises themed around UAV procurement. Infection chain uses a ZIP with a PDF lure containing a link that downloads a Go-based malware (GLUEEGG) to decrypt/launch a Lua loader (DROPCLUE), which then drops/opens a decoy PDF and installs legitimate remote management software (ATERA) via curl/msiexec for remote access.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.