Loading threat actor…
UAC-0041 is a threat cluster tracked by CERT-UA and associated with credential-focused cybercrime targeting Ukrainian users and organizations. The group’s activity is centered on theft of user authentication data and related sensitive information through phishing-led malware delivery. Observed campaigns have impersonated trusted Ukrainian institutions to induce victims to download and execute password-protected archives containing information-stealing malware. UAC-0041 has been linked to the use of commodity stealer malware including MarsStealer and Snake Keylogger, with Formbook observed as a loader in some activity. The malware used by this cluster supports theft of browser credentials and other authentication material, and in the case of MarsStealer also theft of cryptocurrency wallet data, multi-factor authentication application data, local files, and screenshots, with the ability to download and execute additional payloads. Snake Keylogger usage associated with the cluster indicates overlap with broader MaaS-style stealer ecosystems and tradecraft involving staged delivery. The actor’s operations are characterized by phishing-based initial access, social engineering themed around legitimate services or government-related subjects, and post-compromise collection and exfiltration of credentials and other victim data. Based on observed activity, UAC-0041 is best characterized as a financially motivated credential-theft actor rather than a destructive or espionage-focused intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the threat actors that has used Snake Keylogger, specifically with Formbook as a loader.
Credential-theft activity cluster distributing phishing emails themed as a Ukrainian Ministry of Education program, delivering MarsStealer to Ukrainian citizens and domestic organizations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.