Loading story…
Researchers reported that UAC-0226 deployed the GIFTEDCROOK stealer through weaponized WinRAR archives that abused Alternate Data Streams (ADS) and path traversal to hide malicious content and place a .lnk file in the Windows Startup folder. The shortcut launched an obfuscated PowerShell loader, waited briefly, decoded a staged payload stored in C:\ProgramData, and reflectively mapped a headerless PE image into memory using native Windows APIs, giving the malware persistence while reducing file-based detection. The lure document was themed around Ukrainian reconnaissance and UAV personnel, indicating targeting aligned with Ukrainian military-related users.
Once loaded, GIFTEDCROOK harvested data from Chromium browsers, Firefox, documents, archives, VPN profiles, KeePass databases, Java KeyStores, email files, cookies, credentials, and session data before staging and compressing the stolen information for exfiltration. Researchers said the updated chain expands earlier UAC-0226 tradecraft with automatic Startup persistence, hidden archive content, a custom PE format, reflective DLL loading, and execution telemetry sent to attacker-controlled infrastructure including 142.111.194[.]73:8640, while retaining PowerShell-based obfuscation and in-memory execution techniques.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Synaptic Security analyzed a June 2026 campaign attributed to UAC-0226 that delivered GIFTEDCROOK via a weaponized WinRAR archive abusing ADS-based path traversal. The chain used a malicious Startup-folder LNK, obfuscated PowerShell, and reflective loading to deploy an in-memory stealer targeting Ukrainian military-themed recipients.
On 2026-06-24, Synaptic Security published a reverse-engineering analysis describing the updated UAC-0226/GIFTEDCROOK infection chain, including Startup persistence, additive decoding of wt1, reflective DLL mapping, and telemetry to attacker infrastructure. The report assessed the tooling as an evolution of earlier UAC-0226 activity rather than a distinct malware family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceblog.synapticsystems.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a **GIFTEDCROOK** stealer campaign associated with `UAC-0226` to a misconfigured Apache server that exposed thousands of malware staging files. Analysis of the infrastructure uncovered **3,788 files** in an open directory, including **947** each of LNK files, VBS scripts, PowerShell scripts, and PDF decoys, indicating an automated distribution pipeline. The infection chain used a compressed archive to deliver a shortcut file that launched a VBS script, displayed a benign refund-form PDF in Microsoft Edge as a decoy, and retrieved a PowerShell payload from `refundonex[.]com` before beaconing to a tracking API endpoint with a static key. The PowerShell stage was designed to frustrate analysis by running with execution-policy bypass and reconstructing its final payload at runtime. Embedded AES key and IV values were used to decrypt Base64-encoded chunks into a larger script, which was then executed via `Invoke-Expression`; separate reporting on the same activity described the operation as a GIFTEDCROOK stealer sample tied to `UAC-0226` and highlighted how low-effort obfuscation and exposed hosting infrastructure enabled broad malware distribution while complicating static detection.
Jun 29, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Breakglass Intelligence reported that **ACRStealer** is running an active credential-theft operation through multiple delivery chains, including a compromised `.edu` WordPress site and a trojanized **Chris-PC RAM Booster** installer. The malware uses a four-stage infection flow that progresses from PowerShell or installer-based execution to Go and .NET loaders, then decrypts and injects shellcode in memory. Researchers said newer samples introduced a previously undocumented .NET loader, **CoreHubManager**, a new 16-byte XOR key, **AES-256-CBC** shellcode decryption, and **Heaven’s Gate** WoW64 transitions to run x64 code from a 32-bit process. Payloads were also signed with a stolen **ASUSTeK EV code-signing certificate**, allowing binaries such as `sunwukongs.exe` to better evade SmartScreen and other trust controls. Once installed, ACRStealer steals credentials, browser data, DPAPI-protected secrets, Windows Hello NGC keys, smart card certificates, Azure AD OAuth tokens, wallets, documents, and tokens from more than 200 applications, then exfiltrates the data over HTTPS. The malware also uses custom AFD socket operations and dead-drop resolvers hosted on **Steam**, **Google Docs/Slides**, and **Telegram** pages to retrieve command-and-control infrastructure. Breakglass mapped **17 C2 IPs** in the newer cluster and **9 live C2 servers** in the earlier campaign, with the larger set hosted by **VDSINA**, pointing to a concentrated infrastructure footprint. Researchers also found overlap with **SectopRAT**, **AmateraStealer**, **NetSupport RAT**, **OffLoader**, **HIjackLoader/IDATLoader**, and **ClickFix/FakeCAPTCHA** chains, and said ACRStealer has been rebranded as **AmateraStealer** and marketed as a malware-as-a-service offering.
Jun 29, 2026