UAC-0227

Executive Summary

UAC-0227 is a recently identified advanced persistent threat (APT) group active since March 2025, targeting local governments, critical infrastructure, and organizations across the European Union. The group employs sophisticated phishing campaigns using SVG file attachments to deploy stealers like Amatera Stealer and Strela Stealer. Their operations demonstrate moderate technical capability and focus on data collection and potential disruption of targeted sectors.

Goals & Targeting

UAC-0227 targets local governments, critical infrastructure, and various organizations within the European Union, suggesting a strategic focus on sectors that hold sensitive information or could be critical for public welfare. The group's choice of tools like Amatera Stealer suggests an intent to collect sensitive data, potentially for espionage or financial gain. The targeting of critical infrastructure may indicate a desire to disrupt services or gain influence over key societal components.

UAC-0227 is an APT group that has emerged as a threat in March 2025, with its activities observed primarily within the European Union. The group's primary method of attack involves phishing campaigns utilizing SVG file attachments, which serve as a vector for distributing malicious software such as Amatera Stealer and Strela Stealer. These tools are designed to steal sensitive information from infected systems. UAC-0227 has also been observed using ClickFix-style methods to implement their threats, indicating a preference for specific attack vectors and techniques. While the group's operational history is still limited, its targeting of critical infrastructure and local governments suggests an intent to disrupt or gather intelligence that could impact national security or public services. The group's use of relatively new and less commonly known tools indicates moderate sophistication in their tactics and tools. Despite this, UAC-0227 appears to have a focused strategy, aiming to compromise specific types of data and systems.

Key Capabilities

• Phishing campaigns utilizing SVG file attachments
• Deployment of Amatera Stealer and Strela Stealer for data theft
• Use of ClickFix-style methods for threat implementation
• Command-and-control (C2) communication via HTTP/S protocols
• Network persistence through scheduled task creation
• Encrypted exfiltration channels for stolen data
• Lateral movement within compromised networks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAC-0227 has demonstrated a consistent focus on European targets, suggesting potential regional or specific-intelligence interests. Their campaigns are characterized by the use of SVG-based phishing and ClickFix methods for threat deployment. While specific campaign details are limited, the group’s activities indicate a modus operandi that combines targeted phishing with data theft tools to compromise high-value assets. Notable past operations include multiple waves of phishing attacks against critical infrastructure entities.

IOC Patterns

• Spear-phishing emails containing malicious SVG files
• Malicious domains used for C2 communication mimicking legitimate services
• Network traffic anomalies from scheduled task persistence mechanisms
• Presence of encrypted data exfiltration channels

Recommended Actions

• Implement employee training on identifying and reporting suspicious phishing emails
• Monitor network traffic for known TTPs associated with UAC-0227, such as SVG-based phishing
• Conduct regular vulnerability scans and penetration testing to identify potential attack vectors
• Use endpoint detection and response (EDR) solutions to detect malicious activity like Amatera Stealer or Strela Stealer
• Adopt multi-factor authentication (MFA) for critical systems to mitigate credential theft
• Review and enhance incident response plans to address potential APT-like intrusions

Suggested Tags