UAC-0226Threat actor
UAC-0226 is a cyber-espionage group targeting Ukrainian military, law enforcement, and local government entities—particularly near the eastern border—since February 2025. Initial access is achieved via phishing emails containing malicious.xlsm documents that decode and execute base64-encoded payloads stored in spreadsheet cells. Two main tools are used: a.From MISP Galaxy
Last reported 4 months ago, by Trend Micro Research1 report
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“T1036”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1059.001PowerShell
“T1059.001”
- T1070.004File Deletion
“T1070.004”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open“SHADOW-EARTH-066, tracked by CERT-UA as UAC-0226 since 2025, has deployed an updated version of its GIFTEDCROOK information stealer designed for rapid credential and document theft.”
Indicators in its reports
named in the reports above- 3d371ef71e40c34a…b63cd4acda25in 1 report
- 166.0.132[.]237in 1 report
- 136.0.141[.]41in 1 report
- 136.0.141[.]138in 1 report
- 38.225.209[.]229in 1 report
- 136.0.141[.]112in 1 report
- 38.225.209[.]122in 1 report
- 23.26.237[.]80in 1 report
- hxxps://[email redacted][.]dev/pathin 1 report
- malicious.workers[.]devin 1 report
- ssu.gov[.]uain 1 report
- president.gov[.]uain 1 report
- rnbo.gov[.]uain 1 report
- mil.gov[.]uain 1 report
- www.unian[.]netin 1 report
- astrocaf[.]comin 1 report
- 194.58.66[.]82in 1 report
- joymobile.com[.]uain 1 report
- mail.c1.com[.]uain 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.