Loading story…
Attackers spoofed Ukraine's Computer Emergency Response Team in a phishing campaign aimed at delivering the AGEWHEEZE remote access trojan. The activity targeted a broad cross-section of Ukrainian organizations, including government entities, healthcare providers, financial institutions, security firms, educational institutions, and software development companies.
Reporting indicates the campaign was observed between March 26 and 27 and relied on fraudulent messages impersonating CERT-UA to trick recipients into opening malicious content. The operation appears designed to steal access and establish persistent remote control on victim systems through the deployment of the AGEWHEEZE RAT.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
CERT-UA reported that the March 26-27 spoofing campaign was largely unsuccessful, with only a small number of infected personal devices identified belonging to employees of educational institutions. The disclosure clarified the campaign's real-world impact beyond the originally targeted sectors.
On 2026-03-28, the operators behind the CERT-UA spoofing campaign claimed responsibility through a linked Telegram channel. Following this, the activity was tracked under the designation UAC-0255, adding an attribution development to the incident.
Between March 26 and 27, 2026, a phishing campaign impersonating Ukraine's Computer Emergency Response Team targeted government entities, healthcare providers, financial providers, security firms, educational institutions, and software development companies in Ukraine. The operation was intended to deploy the AGEWHEEZE remote access trojan (RAT).
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
CERT-UA reported that threat cluster **UAC-0247** targeted Ukrainian local governments, municipal clinics, emergency hospitals, and in some cases Defense Forces personnel with a phishing campaign delivering the newly identified **`AGINGFLY`** malware. The attacks used humanitarian-aid themed emails, compromised or fake websites, malicious archives, and **`LNK`** files that triggered **`mshta.exe`** to launch **`HTA`** payloads, scheduled tasks, and shellcode injection into legitimate processes before deploying **`RAVENSHELL`**, **`SILENTLOOP`**, and the C# backdoor **`AGINGFLY`**. Separate lures sent through Signal masqueraded as FPV drone operator software updates and used DLL side-loading to install the same malware. The intrusions were aimed at espionage and data theft, with **`AGINGFLY`** enabling remote command execution, file exfiltration, screenshots, keylogging, and arbitrary code execution, while dynamically compiling command handlers received from command-and-control servers. CERT-UA said the operators also stole credentials from Chromium-based browsers with **`CHROMELEVATOR`**, extracted WhatsApp data with **`ZAPIXDESK`**, and used tools including **`RUSTSCAN`**, **`LIGOLO-NG`**, and **`CHISEL`** for reconnaissance, tunneling, and lateral movement; at least one incident also involved **`XMRIG`** delivered through a modified WireGuard binary, indicating cryptomining alongside espionage. The agency urged defenders to restrict execution of **`LNK`**, **`HTA`**, and **`JS`** files and limit abuse of **`mshta.exe`**, **`powershell.exe`**, and **`wscript.exe`**.
Jun 29, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026