ctrlINT What the industry said about every indicator, with the quote

UAC-0194Threat actor

UAC-0194 is a Russian threat actor linked to the exploitation of the Windows zero-day CVE-2024-43451, which was used in attacks against Ukrainian organizations. The group delivered phishing emails containing.url files that, when interacted with, exploited the vulnerability to facilitate the installation of additional payloads, including the SparkRAT trojan.From MISP Galaxy

Last reported 3 months ago, by Google Threat Intelligence1 report

Suspected originRussiaMISP Galaxy

ATT&CK techniques

4 techniques · each with the sentence it comes from
  1. T1021.001Remote Desktop Protocol

    “The threat actor attached a malicious Remote Desktop Protocol (RDP) file to the email, which upon opening resulted in a connection being established between the victim and an open RDP port (3389) hosted on the actor-registered domain chosen to imitate the same academic institutio…”

    Google Threat IntelligenceVendor
  2. T1036Masquerading

    “… versions of the malware observed by GTIG retained the internal aspects of this disguise, in 2025 we identified variants of STOCKSTAY masquerading as other benign applications, such as PDF viewers and calculator utilities.”

    Google Threat IntelligenceVendor
  3. T1047Windows Management Instrumentation

    “Operating system information is collected via the Windows Management Instrumentation (WMI) ManagementObjectSearcher, specifically the following fields:”

    Google Threat IntelligenceVendor
  4. T1480.001Environmental Keying

    “…he threat actor deploys STOCKSTAY at a later stage of operation, following reconnaissance, STOCKSTAY is configured to incorporate environmental keying for its configuration, requiring the malware to be executed either on a specific host, by a specific user, within a specific doma…”

    Google Threat IntelligenceVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “…, that has been continually developed and deployed by the Russia-linked threat actor Turla (aka SUMMIT, Secret Blizzard, VENOMOUS BEAR, UAC-0194) since at least December 2022.”

    Google Threat IntelligenceVendor
    STOCKSTAY Another Day: The Latest Addition to Turla’s Intelligence Gathering Apparatus

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with UAC-0194 here?
No account needed. We do not store your IP address.