Loading threat actor…
UAC-0145 is a Russian state-sponsored threat cluster tracked by CERT-UA as a subcluster of Sandworm, also known as UAC-0002, APT44, and Seashell Blizzard, which is affiliated with Russia’s military intelligence agency, the GRU. Its operations target Ukraine, including military personnel, government infrastructure, telecommunications providers, IT companies, system administrators, and other IT specialists. Its activities encompass initial compromise, reconnaissance, information theft, persistent remote access, and lateral movement. At least one foothold obtained through a trojanized software installer subsequently enabled a destructive attack against a Ukrainian central executive authority. The cluster uses several social-engineering delivery methods: trojanized Windows and Office installers distributed through torrent trackers; messaging-based requests to install purported antivirus software; fake CAPTCHA pages using ClickFix; and fraudulent recruitment. Its recruitment campaign, active since at least May 2026, uses résumé research, recruiter impersonation, messaging conversations, video interviews, and staged technical assessments. Victims receive deliberately failing WireGuard configurations and are then directed to install SopraVPN, a malicious WireGuard-derived client impersonating corporate VPN software. The modified client decrypts embedded commands using AES-256-GCM and conceals configuration values with a custom Base64 alphabet. Windows execution uses PowerShell and scheduled tasks to retrieve additional payloads; Linux execution retrieves an executable through attacker-controlled VPN infrastructure. UAC-0145’s ClickFix operations use compromised websites, visitor filtering, and SMARTAXE to selectively display malicious verification prompts. SMARTAXE employs EtherHiding to retrieve infrastructure information from an Ethereum smart contract. Associated tooling includes the GHETTOVIBE script, SCOUTCURL reconnaissance and exfiltration tool, FLUIDLEECH and LOADLOOP loaders, and FREAKYPOLL Python backdoor. The cluster also distributes COWARDDUCK, an Android backdoor disguised as protective software that steals device information, contacts, files, and real-time geolocation. Its operations abuse legitimate tools and services, including OpenSSH and Tor for remote access and tunneling, rsync for exfiltration, and Dropbox for file uploads. Other observed activity includes theft of keys and Signal and WhatsApp data.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
11 malware families Mallory has associated with this actor across public reporting.
6 additional families tracked in Mallory.
57 indicators attributed to this actor. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.