Loading story…
In September 2025, the Computer Emergency Response Team of Ukraine (CERT-UA) identified a series of targeted cyber espionage attacks against members of the Ukrainian Officers Union. The attacks were attributed to a threat cluster designated as UAC-0245 and involved the deployment of a sophisticated backdoor known as CABINETRAT. The initial infection vector was the distribution of malicious Microsoft Excel XLL add-ins, which were delivered via ZIP archives shared over the Signal messaging app. These ZIP files were disguised as documents related to the detention of individuals attempting to cross the Ukrainian border, increasing the likelihood of successful social engineering. Once executed, the XLL add-in created multiple files on the victim's system, including an executable in the Startup folder, a persistent XLL file in the Excel XLSTART directory, and a PNG image. The attack chain included modifications to the Windows Registry to ensure persistence and leveraged Excel's hidden mode to execute the malicious add-in without user awareness. The XLL add-in extracted shellcode from the PNG file, which was identified as the CABINETRAT backdoor. CABINETRAT is a full-featured backdoor written in C, capable of gathering system information, enumerating installed programs, taking screenshots, listing directory contents, deleting files or directories, executing arbitrary commands, and facilitating file uploads and downloads. The malware communicates with its command-and-control server over a TCP connection, enabling remote operators to maintain long-term, stealthy access to compromised systems. To evade detection, both the XLL payload and the CABINETRAT shellcode incorporate anti-virtualization and anti-analysis techniques, such as checking for multiple processor cores, sufficient RAM, and the presence of common virtualization tools. CERT-UA's alert, referenced as CERT-UA#17479, highlights the ongoing nature of UAC-0245's operations and the increasing sophistication of cyber espionage campaigns targeting Ukraine. The attacks are part of a broader trend of state-sponsored cyber activity in the region, with a significant portion of incidents involving espionage and prepositioning for future operations. Security vendors, including SOC Prime, have responded by curating detection algorithms and Sigma rules to help organizations identify and mitigate UAC-0245 activity. These detection resources are aligned with the MITRE ATT&CK framework and are compatible with various SIEM, EDR, and data lake solutions, providing actionable intelligence for defenders. Security teams are encouraged to leverage these tools and monitor for indicators associated with CABINETRAT and UAC-0245 to proactively defend against similar threats. The incident underscores the importance of vigilance against novel attack vectors, such as XLL-based malware delivered through secure messaging platforms, and the need for continuous improvement in detection and response capabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
By early October 2025, CERT-UA publicly warned about the campaign and released technical details on CABINETRAT, including its persistence, anti-analysis behavior, and command-and-control methods. CERT-EU and SOC Prime also issued detection guidance and Sigma-based content to help defenders identify the activity.
After analyzing the activity, CERT-UA classified the operation under the distinct threat cluster UAC-0245 because the observed tactics, techniques, and procedures differed from previously documented XLL-based attacks. The campaign was noted as separate from earlier activity such as UAC-0002/Sandworm-linked use of XLL files.
In September 2025, CERT-UA identified a targeted cyber-espionage campaign against members of the Ukrainian Officers Union attributed to UAC-0245. The attackers used malicious Excel XLL add-ins delivered via Signal in a ZIP archive named "500.zip" to install the CABINETRAT backdoor.
3 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesocprime.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian government entities were targeted in a cyber-espionage campaign attributed to **UAC-0050** that deployed **Remcos RAT** through a malicious `.lnk` file and a multi-stage chain using `mshta.exe`, obfuscated VBScript, and PowerShell. Researchers said the malware downloaded a decoy document themed around consultancy and Israel Defense Forces training, then established persistence in `AppData` before using unnamed Windows pipes to move decrypted payload data into `cmd.exe` memory, a technique designed to evade EDR and antivirus tools. The analyzed **Remcos 4.9.2 Pro** sample was configured to contact `194.87.31.229:6438` under the botnet name **RemoteHost** and was observed collecting victim data, altering registry settings, and removing browser data. The operation fits a broader pattern of **Remcos** use across phishing and espionage campaigns, where attackers repeatedly rely on lures such as invoices, war-related themes, password-protected documents, and malicious archives to deliver the RAT. Prior reporting has documented Remcos infections using Office exploits, macros, PowerShell loaders, UAC-bypass techniques, process injection, and fileless or in-memory execution, while later tracking of UAC-0050 linked the cluster to continued operations against Ukraine using shifting malware families and suspicious hosting infrastructure. The campaign underscores how a commercially available RAT continues to be adapted by both criminal and state-aligned operators for stealthy access, surveillance, and follow-on intrusion activity.
Aug 15, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
CERT-UA reported that **UAC-0063** compromised a Ukrainian research institution by abusing a hijacked employee email account to resend a legitimate-looking message carrying a malicious macro-enabled document. The infection chain launched an HTA-based **HATVIBE** backdoor, established persistence with a scheduled task, and enabled attackers to deploy a newer **CHERRYSPY** variant compiled as a `.pyd` DLL. CERT-UA said the intrusion was aided by weak defenses, including missing MFA on email, local administrator privileges, and the lack of controls blocking Office macros, `mshta.exe`, and Python execution; it also noted that **CVE-2024-23692** in HFS HTTP File Server had likely been used in separate HATVIBE infections. Bitdefender said the same cluster, also tracked as **TAG-110**, has run a broader cyber-espionage operation since 2022 against government bodies and diplomatic missions across Central Asia and Europe, including embassies in Germany, the UK, the Netherlands, Romania, Georgia, Kazakhstan, and Afghanistan. The group reportedly reused weaponized Word documents stolen from earlier victims to infect new ones and deployed follow-on tools including **DownExPyer/CherrySpy**, **PyPlunderPlug**, and keylogging components tied to **LOGPIE** for file theft, screenshot capture, command execution, removable-media collection, and credential-related surveillance. CERT-UA assessed with medium confidence that UAC-0063 is linked to **APT28/UAC-0001** and Russia's GRU, while Bitdefender said the targeting and tradecraft align with Russian espionage interests but do not yet conclusively prove that connection.
Aug 15, 2026