UAC-0063

Executive Summary

UAC‑0063 is a Russian‑linked espionage threat actor aligned with APT28/Fancy Bear that targets government, diplomatic, and research institutions across Central Asia and Europe. It leverages macro‑enabled Office attachments to deliver the backdoors HATVIBE and CHERRYSPY, exploiting CVE‑2022‑38028 for privilege escalation and employing steganographic encryption to evade detection. The group exfiltrates credentials, documents, and media via HTTPS, USB, and cloud channels while maintaining persistence through scheduled tasks and mshta loaders.

Goals & Targeting

The strategic aim of UAC‑0063 is geopolitical espionage, collecting classified and operational data from government entities, diplomatic missions, scientific institutions, and critical infrastructure in Central Asia and Europe. By infiltrating key decision‑making bodies—particularly those concerning Ukraine, Kazakhstan, and Russia’s neighboring states—the actor seeks to support intelligence gathering for strategic planning, influence regional stability, and potentially back Russian state policy in the Indo‑Pacific and Balkans. The emphasis on privileged accounts, credential theft, mass data exfiltration, and persistence suggests a focus on long‑term information operations rather than short‑cycle financial gain.

Key Capabilities

• Privilege escalation via CVE-2022-38028
• Defense evasion using steganography and encryption
• Spear-phishing with macro-enabled .dotm Office documents
• Use of HATVIBE backdoor for data exfiltration
• Use of CHERRYSPY (DownExPyer) for credential theft and logon monitoring
• Keylogging and clipboard monitoring via LOGPIE
• Screen capture and audio recording
• USB-based data exfiltration with PyPlunderPlug
• Process injection into cmd.exe / Windows-command shell
• Scheduled task creation for persistence
• MShta execution of HTA loaders
• Encrypted HTTP PUT/GET C2 communication (AES)
• Compressed file archives (<16 MB) for exfil
• File deletion post-exfil
• Python-based implant deployment and command execution
• Credential dumping from web browsers and Windows Credential Manager
• Exploit of public-facing software vulnerabilities (HFS, Rejetto)
• Discovery of shared folders and removable media

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAC‑0063 has been active since at least 2021, scaling from targeted attacks on Central Asian diplomatic and research bodies to a broader European footprint that includes Ukrainian government agencies, Russian allies, and international NGOs. Campaigns are orchestrated in stages: initial phishing emails using disguised word‑processing attachments, exploitation of known Windows privilege‑escalation CVEs, delivery of lightweight, obfuscated payloads that persist via scheduled tasks or run‑once mechanisms, and sustained data exfiltration over encrypted channels or removable media. The actor exhibits operational tempo conducive to long‑term surveillance rather than opportunistic disruption, with regular updates to C2 hosts and renewal of TLS certificates to preserve anonymity. While the group has a known association with APT28/Fancy Bear, recent evidence also suggests linkages to other GRU-linked units operating under different aliases (e.g., UAC‑0056, TAG‑110).

IOC Patterns

• hash-md5 of malicious documents and payloads
• malicious domain names used for C2 (e.g., lanmangraphics.com)
• IPv4 addresses linked to C2 servers
• .logs files with archiving size <16 MB
• Python scripts in %LOCALAPPDATA% such as crashreporting.py
• Scheduled task names like Application\SynchronizeTime or Settings\ServiceDispatch
• Registry key AccessVBOM modification for Office macro execution
• mshta.exe processes running HTA loaders
• Encrypted AES C2 payloads with hex prefixes
• USB device enumeration and data transfer via PyPlunderPlug
• File deletion events immediately after upload
• TLS certificate renewal timestamps

Recommended Actions

• Apply patches for CVE-2022-38028 and related Windows kernel updates promptly.
• Configure email gateways to block or quarantine macro-enabled Office documents (.dotm/.doc) and enable attachment sandboxing.
• Implement EDR/XDR solutions with detection rules for HATVIBE, CHERRYSPY, LOGPIE, PyPlunderPlug and Cobalt Strike signatures.
• Block outbound HTTPS traffic to known malicious domains and IPs used by UAC-0063’s C2 infrastructure.
• Enforce strict macro security policies (disable macros by default; enable only digitally signed scripts).
• Monitor for creation of scheduled tasks with atypical names and associated mshta execution; investigate anomalies.
• Restrict execution of unknown Python binaries in %APPDATA% and monitor subprocess.Popen calls. Implement keylogging and screen‑capture detection capabilities; configure alerts for suspicious clipboard activity via LOGPIE. Deploy network segmentation and micro‑segmentation between government and research networks to limit lateral movement. Enforce MFA on privileged accounts, lock out after repeated failed logins and audit credential dumping events. Utilize DLP policies aimed at preventing exfiltration of documents >250 KB or media files; set alerts for large .png uploads. Regularly review and harden registry keys such as AccessVBOM; revoke unnecessary permissions on Office applications. Conduct periodic threat hunting for steganographic content inside images, PDFs, or Office documents; use image‑analysis tools. Maintain a CVE‑tracking system to detect public‑facing software exploits (e.g., HFS, Rejetto) and patch accordingly. Document and mitigate any discovered data deletion patterns that follow successful exfiltration events.