UAC-0185

Executive Summary

UAC‑0185, also known as UNC4221 and other aliases, is a Russia‑aligned threat actor that has been active since at least 2022. The group focuses on Ukrainian defense and industrial organizations, using credential theft via messaging apps, spear‑phishing, and exploitation of public‑facing applications to gain access. It deploys a mixture of custom remote‑access tools, backdoors, and ransomware‑like loaders for persistence and exfiltration.

Goals & Targeting

UAC‑0185 appears driven by a combination of financial gain and strategic influence. While its primary motivation is monetary—stealing credentials to monetize through ransomware or banking malware—it also focuses on high‑value defense infrastructure, suggesting potential espionage objectives. The group’s targeting profile demonstrates precision against critical national sectors in Ukraine and a broader threat landscape that includes finance, energy, and maritime domains worldwide.

Key Capabilities

• Targeted attacks on Ukrainian defense and industrial organizations
• Use of malspam/malvertising to redirect victims to traffic distribution systems
• Email thread hijacking for persistence within email chains
• Deployment of malicious JavaScript downloaders delivering WasabiSeed, ScreenShotter, AHK Bot
• Resident backdoors such as Cobalt Strike beacons, CSharp‑Streamer‑RAT, Rhadamanthys, AnyDesk, Remote Utilities
• Spear‑phishing with obfuscated JavaScript in ZIP attachments containing LNK shortcuts abusing mshta.exe
• Exploitation of legacy Microsoft Excel VBA vulnerabilities (CVE‑2017‑0199 and CVE‑2017‑11882) to deploy loaders like Ande Loader and SmokeLoader
• Persistence via process injection into explorer.exe
• Credential theft from browsers, email clients, FTP, and file transfer applications

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAC‑0185’s activity reveals a consistent focus on Ukrainian defense infrastructure with sporadic global expansion. From early 2022, the group utilized spear‑phishing and credential‑theft via messaging apps, followed by lateral movement through custom remote‑access tools. Operational tempo has remained steady but adaptive: recent campaigns demonstrate use of malicious JavaScript downloaders that spawn a cascade of RATs, as well as banking‑malware deliveries (e.g., Astaroth) in Latin America linked to the same tool chain. Victim types include defense contractors, critical infrastructure providers (energy, telecommunications), financial services, and government agencies across multiple regions including the US, Europe, Asia, and the Middle East.

IOC Patterns

• Randomly generated domain names used by traffic distribution systems
• Malspam/malvertising campaigns with embedded downloaders
• Email thread hijacking techniques for persistence
• ZIP attachments containing malicious LNK shortcuts abusing mshta.exe
• Obfuscated JavaScript code for command-and-control
• Exploitation of CVE‑2017‑0199 / CVE‑2017‑11882 via VBA in Microsoft Excel
• VBS scripts used to drop loaders like Ande Loader or SmokeLoader
• Process injection into explorer.exe for persistence and evasion
• Credential theft plugins targeting browsers, Outlook, Thunderbird, FileZilla, WinSCP

Recommended Actions

• Apply all critical patches including CVE‑2017‑0199 and CVE‑2017‑11882 on all endpoints
• Deploy detection rules aligned with T1548 (UAC bypass) and process injection indicators (T1055)
• Block malicious domain names associated with traffic distribution systems identified in IOC patterns
• Enhance email filtering to detect spear‑phishing attachments, LNK shortcuts and obfuscated JavaScript
• Monitor mshta.exe usage and enforce application whitelisting for PowerShell & VBScript
• Detect installation of remote‑access tools such as AnyDesk and Remote Utilities on corporate networks
• Implement least‑privilege policies and MFA for critical accounts, especially messaging app integrations
• Deploy endpoint detection and response solutions that flag credential-stealer activity in browsers and file‑transfer apps

Suggested Tags