Unit 42 Collaborative Research With Ukraine’s Cyber Agency To Uncover the Smoke Loader Backdoor
Summary: Unit 42 published its first joint research with Ukraine's State Cyber Protection Centre (SCPC SSSCIP) on Smoke Loader backdoor activity in Ukraine from May to November 2023, attributed by CERT-UA to the group UAC-0006. The report documents 23 waves of email-based attacks, and CERT-UA ranked UAC-0006 first in its financial-crimes category as of December 2023, with attempts to steal tens of millions of hryvnias from August to September 2023.
Key Takeaway: CERT-UA's figures put the campaigns at a potential loss of 1 million hryvnias per week on average, with accountants in Ukraine named as a notably increased target - a reminder that a loader first advertised on criminal forums in 2011 is still the entry point for fund theft.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026