UAT-5647 targets Ukrainian and Polish entities with Rom Com malware variants
Summary: Cisco Talos reports that UAT-5647, a threat actor conducting both ransomware and espionage attacks, has accelerated operations against high-profile Ukrainian entities and likely Polish targets, using spear-phishing to deliver two downloaders tracked as RustyClaw (RUST-based) and MeltingClaw (C++-based). These establish persistence for the backdoors DustyHammock and ShadyHammock, with ShadyHammock loading the SingleCamper RomCom variant, and the actor used PuTTY's Plink to tunnel to an internal edge device likely identified as a TP-LINK Wireless G Router WR340G.
What's compelling: Talos assesses the actor's intent as establishing long-term access to exfiltrate data for espionage and then potentially pivoting to ransomware, and the malware's keyboard-language checks indicate Polish entities were also in scope.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026