Loading threat actor…
UAT-10820 is a Russian-speaking, financially motivated threat cluster tracked in connection with the “verification.google” branch of ClearFake-related ClickFix activity. The cluster was observed executing a WebDAV-hosted DLL loader at a Ukrainian government organization in April 2026; the activity was assessed as part of a broader, opportunistic credential- and cryptocurrency-theft operation rather than an intrusion directed exclusively at that organization. The infection chain uses compromised websites, malicious Cloudflare Workers, and blockchain-hosted staged content to present Windows users with fake Google CAPTCHA prompts. Victims are socially engineered into executing commands through the Windows Run dialog, resulting in remote DLL execution through rundll32. The verification.google loader employs API hashing, direct WoW64 system calls, and DLL hollowing before deploying Amatera. Amatera is configured to collect browser data, credentials, cryptocurrency-wallet material, messaging-application data, password-manager data, authenticator data, VPN and remote-access application data, and selected files. UAT-10820 activity also installed a concealed NetSupport Manager client for hands-on remote access and established user-logon persistence through a scheduled task. Cisco Talos assesses with moderate confidence that UAT-10820 is a Russian threat actor. The related ClearFake remote-loader ecosystem has also delivered cryptocurrency-stealing tooling, defense-impairment components, and reverse-proxy payloads, although the delivery-chain relationship between those branches and the verification.google activity was assessed with lower confidence.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
9 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.