DEAFTICK
DEAFTICK is a primitive backdoor written in Go, observed by CERT-UA in phishing campaigns tracked as UAC-0252 targeting Ukraine during January-February 2026. In the reporting, it is also described as a surveillance module deployed alongside SHADOWSNIFF and SALATSTEALER. The campaigns used emails impersonating Ukrainian central executive authorities and regional administrations, urging recipients to update widely used civilian and military mobile applications. Delivery occurred either through attached archives containing EXE files or through links to legitimate websites vulnerable to XSS that executed JavaScript and downloaded an executable; the EXE payloads and scripts were hosted on GitHub resources. CERT-UA associated the activity with individuals discussed on the Telegram channel “PalachPro.” Known DEAFTICK file indicators include Diia_Update_4.7.1_Official.exe (MD5: e457cb42ca5a6ecd8b99d89ed2958b29, SHA-256: b5e685e57c625032ec067be94a2854cce1b7c5a51e8d6bd833841a893d5d88b7), EdgeUpdate.exe (MD5: f3dc1e16cde2995f701c8db509f351c9, SHA-256: e5941df780ae251bcafad3b833f45ee44bd1599ab45b7adf1f1c79510930642d), and build.exe (MD5: dcc2c9a08044e8b3e445f17461d054f1, SHA-256: 7b35b332a999d56d65241a4f35bbce2e9ad2644a84c09f7dbae42e39cd559bcf). Reported network indicators include http://150.241.64.21:8888/client/addclient, http://95.85.224.14:8000/client/addclient, and https://nfkavn.bond/client/addclient. Host-based indicators in the campaign include commands to hide %TMP%\svchost.exe, add a Microsoft Defender exclusion for that file, and create a Run key persistence value named WindowsUpdateService pointing to %TMP%\svchost.exe.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
UAC-0252 Campaign (Jan--Feb 2026) SalatStealer was deployed alongside three other tools in a campaign targeting Ukraine, tracked as UAC-0252 ... Initial vector: CVE-2025-8088 (WinRAR path traversal) distributed via the PalachPro Telegram channel. | SalatStealer was deployed alongside three other tools in a campaign targeting Ukraine, tracked as UAC-0252: DEAFTICK -- surveillance module
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SalatStealer was deployed alongside three other tools in a campaign targeting Ukraine, tracked as UAC-0252: DEAFTICK -- surveillance module
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques“...a link to a legitimate website that is vulnerable to XSS (Cross-site scripting), which, when visited, will execute JavaScript code and download the executable file…”
CERT-UA фіксує ... розповсюдження електронних листів ... із закликом оновити мобільні застосунки... Електронний лист може містити вкладення ... EXE-файл, або ж посилання на легітимний, проте вразливий до XSS ...
Електронний лист може містити вкладення у вигляді архіву, у якому знаходиться EXE-файл
...або ж посилання на легітимний, проте вразливий до XSS ... вебсайт, відвідування якого призведе до виконання JavaScript-коду та подальшого завантаження ... виконуваного файлу
Execution
2 techniquesPersistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueCommand and Control
2 techniqueshXXp://150[.]241.64.21:8888/client/addclient; hXXps://nfkavn[.]bond/client/addclient; hXXps://salat[.]cn/sa1at/ ...
“The EXE files and scripts are hosted on the legitimate GitHub service.”
Other
1 techniqueRecent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A surveillance module used alongside SalatStealer in the UAC-0252 campaign targeting Ukraine.
A primitive Go-based backdoor referenced as used in the CERT-UA-described activity.
Примітивний бекдор, написаний на Go, який маскується під легітимні оновлення (наприклад, EdgeUpdate.exe / Diia_Update_4.7.1_Official.exe) та встановлює персистентність через ключ Run у HKCU.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.