GIFTEDCROOK
GIFTEDCROOK is a C/C++ information stealer used in cyber-espionage operations attributed to the Russia-aligned cluster UAC-0226, also tracked as Shadow-Earth-066, against Ukrainian targets. Reported victim sectors include military innovation hubs, armed forces units, law enforcement entities, and regional/state government institutions, particularly near Ukraine’s eastern border.
Observed delivery includes phishing emails with macro-enabled Excel (.xlsm) attachments using topical lures such as landmine clearance, administrative fines, drone production, and compensation for damaged property. The malicious spreadsheets contained base64-encoded payloads in cells; embedded macros decoded the payload, wrote an executable without a file extension, and launched it. Separate reporting also states UAC-0226 deployed updated GIFTEDCROOK samples via weaponized email campaigns exploiting the WinRAR path traversal vulnerability CVE-2025-8088 using malicious archives and Startup-folder placement.
GIFTEDCROOK is described as stealing browser data from Chrome, Microsoft Edge, and Mozilla Firefox, including saved credentials, cookies, browsing history, browser passwords, and session cookies. Reporting also states it targets VPN credentials, Telegram data, and documents/files, including files matching 35 extensions. Stolen data is archived using PowerShell Compress-Archive and exfiltrated via Telegram, including to a hacker-controlled Telegram chat. One report states the malware deletes itself from the compromised system after collecting credentials and documents.
Associated campaign activity also included deployment alongside a reverse shell/.NET tool embedding a PowerShell reverse shell script sourced from the public GitHub repository PSSW100AVB. High-confidence ATT&CK-relevant behaviors mentioned in the source material include spearphishing attachment delivery, PowerShell use, archive collected data, and exfiltration over web services via Telegram.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
At least two Russia-aligned threat clusters have exploited a high-severity WinRAR flaw ... tracked as CVE-2025-8088 ... patched in WinRAR 7.13 in July 2025. CVE-2025-8088 is a path traversal vulnerability affecting the Windows version of WinRAR that allows attackers to execute arbitrary code. | Shadow-Earth-066 — tracked as UAC-0226 by Ukraine's Computer Emergency Response Team (CERT-UA) — used the vulnerability to deploy an updated version of the GiftedCrook information stealer, which collects credentials and documents and then deletes itself from the compromised system.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Shadow-Earth-066 — tracked as UAC-0226 by Ukraine's Computer Emergency Response Team (CERT-UA) — used the vulnerability to deploy an updated version of the GiftedCrook information stealer, which collects credentials and documents and then deletes itself from the compromised system.
Shadow-Earth-066 — tracked as UAC-0226 by Ukraine's Computer Emergency Response Team (CERT-UA) — used the vulnerability to deploy an updated version of the GiftedCrook information stealer, which collects credentials and documents and then deletes itself from the compromised system.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
In at least one case, attackers used stolen credentials purchased from access brokers on darknet forums to move directly into targeted environments. This approach cuts the time between initial access and active exploitation, bypassing traditional phishing entirely.
both begin with weaponized emails ... Shadow-Earth-066 ... emails targets with lures that use military or government-related topics relevant to Ukraine with a malicious RAR archive included. ... Earth Dahu ... sends a spear-phishing email from a compromised government account that includes a weaponized archive containing documents crafted to appear legitimate.
Execution
1 technique
Execution
Persistence
3 techniques
Persistence
In at least one case, attackers used stolen credentials purchased from access brokers on darknet forums to move directly into targeted environments. This approach cuts the time between initial access and active exploitation, bypassing traditional phishing entirely.
The archive abuses the WinRAR path traversal flaw so attackers can place a malicious shortcut (LNK) or payload in a Windows Startup location ... attackers can craft malicious archive files that write files ... into Windows Startup locations that enable code execution after login.
Privilege Escalation
3 techniques
Privilege Escalation
In at least one case, attackers used stolen credentials purchased from access brokers on darknet forums to move directly into targeted environments. This approach cuts the time between initial access and active exploitation, bypassing traditional phishing entirely.
The archive abuses the WinRAR path traversal flaw so attackers can place a malicious shortcut (LNK) or payload in a Windows Startup location ... attackers can craft malicious archive files that write files ... into Windows Startup locations that enable code execution after login.
Stealth
3 techniques
Stealth
Shadow-Earth-066 ... used the vulnerability to deploy an updated version of the GiftedCrook information stealer, which collects credentials and documents and then deletes itself from the compromised system.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer used to rapidly harvest credentials and documents, including browser passwords, session cookies, and files matching multiple extensions, after exploitation of the WinRAR flaw.
Stealer targeting VPN credentials and Telegram data.
Information-stealing malware delivered via malicious Excel files in phishing emails targeting Ukrainian institutions.
GIFTEDCROOK is a stealer malware that extracts browser data and exfiltrates it via Telegram to threat actors.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.