Loading story…
CERT-UA disclosed a phishing campaign targeting Ukrainian organizations with a RAR archive themed around preserving video evidence of crimes by the Russian army. The lure delivered an executable that opened a decoy PDF styled as a National Police of Ukraine document, dropped supporting BAT, DAT, and DLL files into the Windows temporary directory, and established persistence through Run registry keys. CERT-UA tracked the activity as UAC-0026 and identified the DLL payload as HeaderTip, malware designed to download and execute additional DLLs while maintaining access on compromised systems.
Further analysis from eSentire assessed with high confidence that HeaderTip operates as both a backdoor and a loader, using obfuscation and Dynamic DNS through ChangeIP to sustain command-and-control connectivity. The malware reportedly communicated with a hardcoded C2 domain, including product2020.mrbasic[.]com, over HTTP POST requests on port 8080, with CERT-UA also linking infrastructure to 104[.]155.198.25. SentinelOne associated the campaign with the suspected Chinese threat actor Scarab, and CERT-UA said similar activity had been observed previously, indicating an established intrusion pattern rather than a one-off attack.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
CERT-UA publicly reported the campaign, describing the malicious RAR archive, dropped BAT/DAT/DLL files, Run key persistence, and C2 infrastructure including product2020.mrbasic[.]com and 104[.]155.198.25. The advisory also included host, network, and registry indicators of compromise.
CERT-UA detected the malware campaign on March 22, 2022 at a Ukrainian organization. It tracked the activity as UAC-0026 and classified the reconstructed DLL payload as HeaderTip.
The decoy PDF embedded in the malware carried National Police of Ukraine instructions on preserving video evidence of crimes by the Russian military. Its metadata indicated it was created, issued, and signed on March 16, 2022.
CERT-UA stated that similar attacks associated with this activity were observed in September 2020. This indicates the campaign or closely related tradecraft predates the 2022 disclosure.
The Scarab malware family was first observed in 2012 targeting organizations in Russia, Ukraine, the United States, Chile, and Syria. This establishes the earlier history of the threat actor later linked to the Ukraine-focused activity.
eSentire analyzed HeaderTip as a phishing-delivered malware that functions as both a backdoor and a loader, using Registry Run keys and ChangeIP-backed dynamic DNS for persistence and command-and-control. The analysis detailed the Ukrainian police-themed decoy PDF, dropped components, and HTTP POST communications over port 8080.
SentinelOne reported that the Ukraine-targeting activity was tied to the suspected Chinese threat actor Scarab. This added an attribution development to the HeaderTip/UAC-0026 story.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.
Jun 29, 2026
ClearSky reported a suspected Russian espionage campaign targeting Ukrainian entities using phishing emails that deliver two previously undocumented malware families: the **BadPaw** loader and the **MeowMeow** backdoor. The infection chain begins with a lure email (sent from `ukr[.]net` to appear credible) containing a link that first loads an unusually small image functioning as a tracking pixel to confirm user interaction, then redirects victims to download a ZIP archive. When opened, the archive launches an HTA that displays a Ukrainian-language decoy document about border-crossing appeals while executing background stages that deploy the .NET-based BadPaw loader, which then retrieves and installs the MeowMeow backdoor from a remote server; the HTA also performs sandbox/analysis-evasion checks. The activity was attributed with **moderate confidence** to **APT28** based on targeting, geopolitical lures, and technique overlaps with prior Russian operations. Separate reporting also noted CERT-UA warnings about other phishing-driven malware activity against Ukrainian government institutions (including **SHADOWSNIFF**, **SALATSTEALER**, and a Go backdoor **DEAFTICKK** attributed to **UAC-0252**), but that campaign is distinct from the BadPaw/MeowMeow intrusion chain and should not be conflated with the APT28-linked activity.
Jun 29, 2026
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026