UAC-0227
UAC-0227 is a threat actor tracked by CERT-UA/SSSCIP and described in the provided content as a Russia-linked APT group active since at least March 2025. The group has targeted local governments/local authorities, critical infrastructure facilities, the Central Communications Commission, joint ventures, and Territorial Recruitment and Social Support Centers (TRCs and SSCs). The content also states that earlier UAC-0227 campaigns in late 2023 targeted European Union countries. Reported activity consists primarily of phishing campaigns using ClickFix-style tactics and malicious SVG file attachments, with the SVG files opening in web browsers by default. These campaigns have been used to distribute stealers including Amatera Stealer and Strela Stealer; the content also states UAC-0227 distributed ransomware via SVG files. The only alias directly provided in the content is uac_0227.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- government
- critical-infrastructure
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
UAC-0227 conducts espionage against Ukrainian local governments, critical infrastructure, and communications entities, using email-based delivery of ransomware via SVG files. Past activity also targeted EU countries.
Phishing campaigns targeting Ukrainian local authorities and critical infrastructure using ClickFix-style lures and SVG attachments to deliver commodity stealers.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.