UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Summary: TrendAI attributed a previously undocumented .NET infostealer and RAT called ASHVEIN, internally named "TelemetryBrowser," to the Russia-aligned actor UAC-0099 in attacks on Ukrainian government personnel, tracking the cluster as Earth Sirrush. ASHVEIN steals credentials from Chrome and Firefox, captures GDI screenshots, enumerates and retrieves files, runs PowerShell remote shells, fingerprints systems, and uses encrypted command-and-control, with tasking hidden in invisible HTML elements and a GitHub-based dead drop resolver as fallback.
What's compelling: UAC-0099 has targeted Ukrainian government, defense, border guard, and logistics entities since at least mid-2022, and ESET's November 2025 report says the crew can serve as an initial access broker for Sandworm, the Russian APT known for destructive attacks against Ukraine.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026