UAC-0099 is a risk actor group that has been concentrating on state officers, protection forces, and defense-industrial companies in a sequence of subtle cyberattacks that Ukraine\u2019s CERT-UA has been investigating.<\/p>\n

The assaults sometimes provoke with phishing emails from UKR.NET addresses, that includes topics like \u201ccourt docket summons\u201d and hyperlinks to legit file-sharing companies, typically shortened by way of URL shorteners. <\/p>\n

These hyperlinks result in double-archived information containing malicious HTML Utility (HTA) information. <\/p>\n

Focusing on Ukrainian Protection <\/strong><\/h2>\n
Upon execution, the HTA information deploy obfuscated VBScript that creates momentary textual content information with HEX-encoded knowledge and PowerShell code<\/a>, alongside a scheduled process named \u201cPdfOpenTask.\u201d <\/p>\n
This process executes the PowerShell script, which decodes the information right into a .txt file, renames it to an executable like \u201cAnimalUpdate.exe,\u201d and units up one other scheduled process \u201cAnimalSoftUpdateAnimalSoftware\u201d to make sure persistence. <\/p>\n
\n
$\"MATCHBOIL$
Instance of an e mail and a decoy file<\/figcaption><\/figure>\n<\/div>\n
This chain deploys the MATCHBOIL loader, probably changing earlier variants like LONEPAGE, and facilitates the loading of extra payloads such because the MATCHWOK backdoor and DRAGSTARE stealer. <\/p>\n
CERT-UA notes<\/a> that UAC-0099\u2019s shifting techniques, methods, and procedures underscore the group\u2019s persistent evolution, adapting to defenses whereas sustaining a concentrate on espionage and knowledge exfiltration in Ukraine\u2019s essential sectors.<\/p>\n
Technical Breakdown of Malware Elements<\/strong><\/h2>\n
Developed in C#, MATCHBOIL serves as a loader that gathers system fingerprints together with CPU ProcessorId by way of WMI queries (e.g., \u201cBFEBFBFF000806EA\u201d), BIOS SerialNumber, username, and MAC deal with concatenating them into an \u201cSN\u201d HTTP header for command-and-control (C2) communications. <\/p>\n
It employs HTTP GET requests to URIs like \u201c\/articles\/pictures\/forest.jpg\u201d on servers akin to geostat[.]lat, extracting payloads by way of regex patterns for \u201c