Loading story…
CERT-UA reported that UAC-0063 compromised a Ukrainian research institution by abusing a hijacked employee email account to resend a legitimate-looking message carrying a malicious macro-enabled document. The infection chain launched an HTA-based HATVIBE backdoor, established persistence with a scheduled task, and enabled attackers to deploy a newer CHERRYSPY variant compiled as a .pyd DLL. CERT-UA said the intrusion was aided by weak defenses, including missing MFA on email, local administrator privileges, and the lack of controls blocking Office macros, mshta.exe, and Python execution; it also noted that CVE-2024-23692 in HFS HTTP File Server had likely been used in separate HATVIBE infections.
Bitdefender said the same cluster, also tracked as TAG-110, has run a broader cyber-espionage operation since 2022 against government bodies and diplomatic missions across Central Asia and Europe, including embassies in Germany, the UK, the Netherlands, Romania, Georgia, Kazakhstan, and Afghanistan. The group reportedly reused weaponized Word documents stolen from earlier victims to infect new ones and deployed follow-on tools including DownExPyer/CherrySpy, PyPlunderPlug, and keylogging components tied to LOGPIE for file theft, screenshot capture, command execution, removable-media collection, and credential-related surveillance. CERT-UA assessed with medium confidence that UAC-0063 is linked to APT28/UAC-0001 and Russia's GRU, while Bitdefender said the targeting and tradecraft align with Russian espionage interests but do not yet conclusively prove that connection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
CERT-UA reported that an analogous malicious DOCX lure was uploaded from Armenia and targeted the Armenian Ministry of Defense while purporting to come from Kyrgyzstan's defense ministry. The document reused a similar macro-based infection approach associated with UAC-0063.
On July 8, 2024, UAC-0063 compromised a Ukrainian scientific research institution by resending a legitimate-looking email from a hijacked employee account with a malicious macro-enabled attachment. The infection chain deployed the HATVIBE backdoor, established persistence with a scheduled task, and later delivered a CHERRYSPY variant compiled as a .pyd DLL.
CERT-UA reported numerous cases in June 2024 where HATVIBE was installed through likely exploitation of CVE-2024-23692 in Rejetto HFS HTTP File Server. The agency said this showed UAC-0063 used multiple initial compromise vectors.
Bitdefender Labs said it has monitored UAC-0063, also tracked as TAG-110, since 2022 as part of an ongoing cyber-espionage campaign targeting high-value organizations.
Bitdefender published research describing UAC-0063 as an active cyber-espionage campaign targeting government entities and diplomatic missions in Central Asia and several European countries. The company said the group's interests and tradecraft overlap with Russian espionage objectives but that available technical evidence was insufficient to confirm or refute a link to APT28.
Bitdefender said the latest infection attempt cited in its report occurred on November 21, 2024, using a link to a lure document named "Инфо о запуске нового проекта ec.doc" hosted on cloud-mail[.]ink. The attempt followed the group's established macro-enabled HATVIBE delivery pattern.
CERT-UA disclosed its investigation of the July 8 intrusion, identified HATVIBE and CHERRYSPY malware, and assessed with medium confidence that UAC-0063 is associated with APT28/UAC-0001 linked to Russia's GRU General Staff. The report also published infrastructure and file indicators tied to the activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-UA reported that threat cluster **UAC-0247** targeted Ukrainian local governments, municipal clinics, emergency hospitals, and in some cases Defense Forces personnel with a phishing campaign delivering the newly identified **`AGINGFLY`** malware. The attacks used humanitarian-aid themed emails, compromised or fake websites, malicious archives, and **`LNK`** files that triggered **`mshta.exe`** to launch **`HTA`** payloads, scheduled tasks, and shellcode injection into legitimate processes before deploying **`RAVENSHELL`**, **`SILENTLOOP`**, and the C# backdoor **`AGINGFLY`**. Separate lures sent through Signal masqueraded as FPV drone operator software updates and used DLL side-loading to install the same malware. The intrusions were aimed at espionage and data theft, with **`AGINGFLY`** enabling remote command execution, file exfiltration, screenshots, keylogging, and arbitrary code execution, while dynamically compiling command handlers received from command-and-control servers. CERT-UA said the operators also stole credentials from Chromium-based browsers with **`CHROMELEVATOR`**, extracted WhatsApp data with **`ZAPIXDESK`**, and used tools including **`RUSTSCAN`**, **`LIGOLO-NG`**, and **`CHISEL`** for reconnaissance, tunneling, and lateral movement; at least one incident also involved **`XMRIG`** delivered through a modified WireGuard binary, indicating cryptomining alongside espionage. The agency urged defenders to restrict execution of **`LNK`**, **`HTA`**, and **`JS`** files and limit abuse of **`mshta.exe`**, **`powershell.exe`**, and **`wscript.exe`**.
Jun 29, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.
Jun 29, 2026