Loading threat actor…
UAC-0247 is a cyber threat cluster tracked by CERT-UA that has conducted an active campaign against Ukraine since early 2026. The cluster has primarily targeted Ukrainian local government bodies, municipal authorities, municipal healthcare institutions, clinical hospitals, emergency medical services, and emergency hospitals. It has also targeted representatives of Ukraine’s Defense Forces and FPV drone operators. The actor’s activity is consistent with espionage-focused intrusions, with additional opportunistic abuse of compromised systems for cryptocurrency mining observed in at least some incidents. UAC-0247 commonly gains initial access through phishing lures themed around humanitarian aid proposals or related discussions. Victims are directed to malicious links that lead to archive downloads, often via AI-generated fake websites or compromised legitimate websites abused to deliver malicious content. The infection chain typically relies on archive-contained shortcut files that trigger HTA-based execution, decoy content, scheduled tasks, shellcode injection into legitimate processes, and staged payload delivery. In separate activity against FPV drone operators, the cluster used trojanized software distributed via Signal and DLL side-loading to deploy malware. The cluster has used AGINGFLY as a core malware family. AGINGFLY is a C# remote access tool that supports command execution, file download, screenshot capture, keylogging, arbitrary code execution, and remote control of infected systems. A notable design feature is its retrieval of command handlers from command-and-control infrastructure as source code, followed by dynamic compilation on the victim host at runtime. UAC-0247 has also used SILENTLOOP for persistence and command execution, including retrieval of updated command-and-control information from Telegram; RAVENSHELL or a TCP reverse shell as staging or access tooling; CHROMELEVATOR to steal credentials and other sensitive data from Chromium-based browsers; and ZAPIXDESK to extract WhatsApp data. Additional tooling observed in victim environments includes RustScan for network scanning and Ligolo-ng and Chisel for covert tunneling. Observed post-compromise behavior includes credential theft, keylogging, reconnaissance, scanning, lateral movement, persistence, covert tunneling, and broader post-exploitation activity. The actor has stolen sensitive data from browsers and WhatsApp for Windows and has conducted internal network discovery after initial compromise. In at least one case, compromised infrastructure was also used to run cryptocurrency-mining software, indicating secondary monetization or resource abuse alongside espionage objectives. UAC-0247 was previously tracked as UAC-0244.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
46 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
12 malware families Mallory has associated with this actor across public reporting.
7 additional families tracked in Mallory.
296 indicators attributed to this actor. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.