UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign
Summary: CERT-UA disclosed a campaign observed between March and April 2026, attributed to a cluster dubbed UAC-0247, that targeted Ukrainian government bodies and municipal healthcare institutions, mainly clinics and emergency hospitals, with malware that steals data from Chromium-based browsers and WhatsApp. The chain begins with an email posing as a humanitarian aid proposal that leads to a Windows Shortcut file executing a remote HTA via mshta.exe, then delivers a shellcode injector, the RAVENSHELL reverse shell, the C# AGINGFLY remote-control malware communicating over WebSockets, and a PowerShell script called SILENTLOOP that retrieves its command-and-control address from a Telegram channel.
Why it matters: CERT-UA's review of about a dozen incidents found the attackers used the access for reconnaissance, lateral movement, and theft of credentials and data from WhatsApp and Chromium browsers, and it later reattributed the activity to individuals previously tracked as UAC-0244 - a reminder that cluster names are provisional while the stolen credentials are not.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026