UAC-0184 Expands HTA Loader With Bitdefender and Plane9 Sideload Chains

Researchers reported that UAC-0184—also tracked as UNC5435 and MB-0007—is using spearphishing LNK files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke bitsadmin and mshta to retrieve HTA payloads from disposable infrastructure hosted on Cloudflare Pages, Netlify, and novelty TLDs, then fetch dctrprraclus.zip. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an AES-256-CBC base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext.

The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate Plane9 components, progressing through Cluster-Overlay64.exe, Plane9Engine.dll, openvr_api.dll, kernel-diag.lib, and a decoded evr.dll stage that extracts filter.bin, whose pseudo-PNG IDAT data is XOR-decoded and LZNT1-decompressed into a final bundle. A parallel path uses the signed Bitdefender Endpoint Security deployer bddeploy.exe to sideload a malicious deploy.dll via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed VSLauncher.exe and a PassMark-derived input.dll believed to provide covert networking and possible process-dump capability, while telemetry tied to trojan.leopard/bitsuh and multicast or TCP traffic on port 31339 has emerged as a consistent hunting lead.