Loading malware…
AGINGFLY is a C# remote access trojan targeting Windows systems. It provides remote command execution, file downloading, screenshot capture, keystroke logging, and arbitrary code execution, including execution in memory. It communicates with its command-and-control server over WebSockets and encrypts traffic using AES-CBC with a static key. Rather than embedding command handlers, AGINGFLY retrieves their source code from its server and dynamically compiles it on the infected host.
AGINGFLY has been deployed by the threat cluster UAC-0247 in espionage campaigns against Ukrainian local government bodies and municipal healthcare institutions, including clinical hospitals and emergency medical services. Distribution has also targeted Ukrainian defense personnel and FPV drone operators. Infection chains use humanitarian-aid-themed phishing emails that direct victims to compromised or fabricated websites hosting malicious archives. Windows shortcuts and HTML Applications initiate staged execution leading to AGINGFLY. A separate delivery route uses Signal messages advertising an updated drone-operator application, with DLL side-loading launching the malware.
Within these intrusions, AGINGFLY provides remote control alongside complementary tools. SILENTLOOP supports persistent access and command execution, while ChromeElevator and ZAPiXDESK are used to extract browser credentials and WhatsApp data, respectively. These companion-tool functions are distinct from AGINGFLY's established remote-access capabilities.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
PhantomCaptcha (UAC-0244) cible des municipalités et établissements de santé ukrainiens [...] déployant AGINGFLY (RAT C# WebSocket).
PhantomCaptcha (UAC-0244) cible des municipalités et établissements de santé ukrainiens [...] déployant AGINGFLY (RAT C# WebSocket).
Hackers have targeted Ukrainian hospitals and local government bodies in a new espionage campaign using a malware tool dubbed AgingFly, researchers say.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Category: cyberwar Malware Non-U.S. Phishing
Malicious emails masquerading as offers for humanitarian assistance have been sent by UAC-0247 to lure recipients into clicking an embedded link that diverts to either a breached website or an AI-generated site, where an LNK file-containing archive is downloaded, according to CERT-UA.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
Running the LNK triggers an HTA file that shows a decoy form while establishing a scheduled task that executes a shellcode-injecting EXE payload.
A distinguishing feature of AGINGFLY compared to similar malware is the absence of built-in command handlers in its code. Instead, they are retrieved from the C2 server as source code and dynamically compiled at runtime.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
A TCP connection encrypted using the XOR cipher is established to the C2 server for executing commands via the Command Prompt in Windows.
The link redirects to a legitimate site that had been compromised via a cross-site scripting (XSS) vulnerability, or to a fake site generated using an AI tool.
Running the LNK triggers an HTA file that shows a decoy form while establishing a scheduled task that executes a shellcode-injecting EXE payload.
... підвантаження якої ... із застосуванням механізму DLL side-loading ...
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
Running the LNK triggers an HTA file that shows a decoy form while establishing a scheduled task that executes a shellcode-injecting EXE payload.
For persistence, the attackers deployed the malware AGINGFLY alongside a PowerShell script, SILENTLOOP, which manages commands, updates configuration, and retrieves C2 server data via Telegram with backup mechanisms.
Running the LNK triggers an HTA file that shows a decoy form while establishing a scheduled task that executes a shellcode-injecting EXE payload.
downloads and runs an EXE payload that injects shellcode into a legitimate process
Unlike typical malware, it doesn’t store command functions locally, instead, it downloads them from the server and compiles them on the fly, making it more flexible and harder to detect.
downloads and runs an EXE payload that injects shellcode into a legitimate process
... підвантаження якої ... із застосуванням механізму DLL side-loading ...
It provides the attacker with a full set of remote control capabilities, including command execution, file downloading, screenshot capture, keylogger activation, and in-memory code execution.
It provides the attacker with a full set of remote control capabilities, including command execution, file downloading, screenshot capture, keylogger activation
can decrypt and extract sensitive information, like cookies and saved passwords, from Chromium-based browsers
Threat actors then proceed to launch a two-stage loader, eventually resulting in the deployment of the C#-based AgingFly malware, which is used alongside open-source security tools to steal Chromium browser-stored data and WhatsApp for Windows information.
uses publicly available utilities, like the RustScan port scanner
According to the researchers, the actor engages in reconnaissance activity
tries to move laterally on the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools
The hackers attempted to steal sensitive data and, in some cases, exploit compromised systems to mine cryptocurrency, CERT-UA said.
It provides the attacker with a full set of remote control capabilities, including command execution, file downloading, screenshot capture, keylogger activation
CERT-UA said AgingFly allows attackers to remotely control an infected computer, enabling them to execute commands, download files, capture screenshots...
distribution of malicious ZIP archives via Signal
PhantomCaptcha (UAC-0244) ... déployant AGINGFLY (RAT C# WebSocket)
uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools
A distinguishing feature of AGINGFLY compared to similar malware is the absence of built-in command handlers in its code. Instead, they are retrieved from the C2 server as source code and dynamically compiled at runtime.
The core remote access tool used across this campaign is AGINGFLY, written in the C# programming language. It provides the attacker with a full set of remote control capabilities
Communication with the C2 server runs through web sockets, and all traffic is encrypted using the AES-CBC algorithm with a static key.
AgingFly is a C# malware that provides its operators with remote control, command execution, file exfiltration
The hackers attempted to steal sensitive data and, in some cases, exploit compromised systems to mine cryptocurrency, CERT-UA said.
87 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.