Loading story…
CERT-UA warned that a phishing campaign targeting Ukrainian organizations used emails impersonating the National Police of Ukraine to deliver password-protected DOCX attachments disguised as criminal investigation reports. The documents were macro-free but contained embedded OLE objects that, when opened by a user, created and executed a JavaScript file, which then used PowerShell to retrieve an executable payload from Discord CDN and infect the victim with OutSteel malware. CERT-UA linked the activity to the UAC-0056 threat group and published file, host, process, and network indicators of compromise.
Technical analysis of one lure showed the dropped script writing a file to the Temp directory, launching it with wscript.exe, downloading putty.exe from Discord, renaming it to GoogleChromeUpdate.exe, and executing it. A related sample reviewed alongside the campaign used an auto-running Excel VBA macro that invoked certutil.exe to fetch a batch payload, illustrating the broader use of weaponized Office documents against Ukrainian entities during the Russia-Ukraine conflict. CERT-UA advised defenders to block unnecessary Internet services such as Discord and prevent Microsoft Office applications from spawning risky child processes including wscript.exe and powershell.exe.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CERT-UA published a warning about a phishing campaign impersonating the National Police of Ukraine. The emails carried password-protected DOCX attachments with embedded objects that dropped JavaScript, used PowerShell to fetch payloads from Discord, and led to OutSteel infections; CERT-UA attributed the activity to UAC-0056 and released IOCs.
CERT-UA stated that one OutSteel sample associated with the campaign had a compilation date of 2022-01-30.
A technical analysis documented two malicious Office files used against Ukrainian organizations: an Excel file with an auto-executing VBA macro that downloaded Ugrfa.bat, and a macro-free DOCX lure masquerading as a National Police of Ukraine report whose embedded object dropped JavaScript that downloaded putty.exe from Discord and executed it as GoogleChromeUpdate.exe. The article noted CERT-UA identified the downloaded payload as the OutSteel Trojan.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukrainian organizations were targeted in a phishing campaign attributed to **UAC-0056**—also tracked as **SaintBear**, **UNC2589**, and **TA471**—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved **Elephant Dropper**, **Elephant Downloader**, **Elephant Implant**, and **Elephant Client**, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the **GraphSteel** and **GrimPlant** backdoors. Targets reportedly included Ukrainian entities such as **ICTV**, continuing a pattern of espionage activity against government and state-linked organizations. The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as `BitdefenderWindowsUpdatePackage.exe`. In those incidents, victims were directed to malicious infrastructure including `forkscenter[.]fr`, with follow-on payloads fetched from Discord and resulting in **Cobalt Strike Beacon**, **GraphSteel**, and **GrimPlant** infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, **PuTTY**, and **FileZilla**.
Aug 15, 2026
Ukraine’s CERT-UA reported active exploitation of a Microsoft Office zero-day, **CVE-2026-21509** (a security feature bypass), attributed to Russia-linked **UAC-0001 / APT28 (Fancy Bear)** and used to target Ukrainian government bodies and organizations across the EU. Microsoft disclosed the flaw with a warning that it was already being exploited in the wild, and CERT-UA observed rapid weaponization: a lure document titled `Consultation_Topics_Ukraine(Final).doc` appeared shortly after disclosure and was themed around EU discussions on Ukraine, suggesting the exploit chain was prepared in advance. CERT-UA also described a parallel phishing campaign impersonating the Ukrhydrometeorological Center, sent to 60+ recipients largely in Ukrainian central executive bodies. The attack chain described includes opening a malicious DOC that triggers a **WebDAV** connection to attacker infrastructure, downloads a shortcut (`.lnk`) used to stage additional payloads, and deploys components including a DLL masquerading as a legitimate Windows component (e.g., `EhStoreShell.dll`) with shellcode hidden in a decoy file (e.g., `SplashScreen.png`), alongside persistence techniques such as **COM hijacking** (registry modification) and scheduled task creation.
Jun 29, 2026
Microsoft disclosed that the Russia-linked threat actor **Storm-0978** used malicious Microsoft Word documents to exploit **`CVE-2023-36884`**, a remote code execution flaw in the Windows HTML component, in spear-phishing campaigns against government, defense, and other organizations in Europe and North America. The lures referenced Ukrainian political affairs and groups such as the Ukrainian World Congress, and the activity was tied to delivery of a backdoor with similarities to **RomCom**, alongside credential theft and follow-on intrusion activity. Microsoft assessed the actor as pursuing both **financially motivated ransomware and extortion** operations and separate **espionage-oriented** campaigns, with links to RomCom distribution and ransomware families including Industrial Spy and Underground. The vulnerability affected multiple Windows, Windows Server, and Microsoft Office versions, and Microsoft issued security updates for **`CVE-2023-36884`** while urging organizations to patch immediately, use Microsoft Defender protections, block child process creation from Office applications, and apply the registry-based mitigation **`FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION`** where patching or newer protections were not available.
Aug 6, 2026