UAC-0063Threat actor
UAC-0063 is a threat actor linked to Russian APT28, known for targeting government entities in Ukraine and Central Asia for cyber espionage operations. They utilize keyloggers, backdoors, and malware like Hatvibe and Cherryspy to compromise systems and exfiltrate sensitive information.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io3 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1056.001Keylogging
“This malware (MD5sum : 889B83D375A0FB00670AF5276816080E) is written in C++, and has for main functionality keylogging and screenshooting.”
- T1059.009Cloud API
“The shellcode launches a Covenant Grunt that uses the Koofr cloud API as a covert command-and-control channel.”
- T1053.005Scheduled Task
“HATVIBE runs from a scheduled task via mshta.exe and pulls further modules, reportedly leading to the CHERRYSPY backdoor.”
- T1059.005Visual Basic
“The infection begins with Visual Basic macros embedded in the Word documents.”
- T1204.005Malicious Library
“Figure 4 - Screenshot of the DllMain function of the prnfldr.dll malicious library”
- T1684Social Engineering
“The use of shapes is a quite common social engineering technique as it pushes the target to activate the macro in order to see the document’s content.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
APT28: An Evolution of Tradecraft from X-Agent to LLM Malware“We documented the Double-Tap campaign, which links back to older Zebrocy operations and the cluster tracked as UAC-0063 and attribute this activity to APT28 with medium confidence.”
-
APT28 Operation Phantom Net Voxel: BeardShell & Covenant“…has shifted its operations to targets in Tajikistan, as noted by Recorded Future in May 2025, although a conclusive attribution between UAC-0063 and APT28 has yet to be established.”
-
Double-Tap: APT28-Linked Espionage on Kazakhstan“Uncover the details of UAC-0063 cyberespionage campaign in Kazakhstan and its potential connection to APT28”
Indicators in its reports
named in the reports above- gateway.filen[.]netin 1 report
- gateway.filen-1[.]netin 1 report
- gateway.filen-6[.]netin 1 report
- egest.filen[.]ioin 1 report
- ingest.filen[.]ioin 1 report
- 915179579ab7dc358c41ea99e4fcab52in 1 report
- 66007a1ca6d07ebb4ed85bf82e79719din 1 report
- 608877a9e11101da53bce99b0effc75bin 1 report
- 0fbc2bf2f66fc72c521a9b8561bab1dain 1 report
- i[.]ecin 1 report
- tutamail[.]comin 1 report
- f9685510dd90c058…e0c9edae6ee3in 1 report
- 889b83d375a0fb00670af5276816080ein 1 report
- 81159738f7ffb50d5bc3c75e5e0ac546in 1 report
- koofrapp.koofr[.]netin 1 report
- icedriveapi.icedrive[.]netin 1 report
- filengateway.filen[.]ioin 1 report
- gateway.filen-2[.]netin 1 report
- gateway.filen-3[.]netin 1 report
- gateway.filen-4[.]netin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.