UAC-0241

Executive Summary

UAC‑0241 (also known as TAG‑160/161) is a financially motivated threat actor that operates a malware-as-a-service model targeting logistics, transportation and related industries worldwide. By impersonating reputable firms such as Booking.com and freight‑matching platforms, it delivers the CastleLoader/CASTLERAT family via phishing emails, malicious URLs, and .URL shortcuts, achieving initial access, lateral movement and persistence across victim networks.

Goals & Targeting

The strategic objective is economic gain through credential theft, data exfiltration, and ransomware capabilities. By exploiting logistics and transportation sectors—often with weak email security—the actor increases hit rates on organizations that handle sensitive supply‑chain information, financial data, or government-related logistics. Its impersonation tactics also aim to erode trust in legitimate service providers. Targets span education institutions, government bodies, defense ministries, healthcare facilities, manufacturing plants, maritime operations and financial services—typically those with high-value data streams and legacy systems vulnerable to exploit chains.

Key Capabilities

• Impersonates logistics firms and Booking.com brands in phishing campaigns
• Uses ClickFix technique to deliver CastleLoader malware
• Spoofs legitimate email addresses for credibility
• Exploits freight‑matching platforms to target and message victims
• Deploys compromised infrastructure to send phishing emails
• Distributes RMM tools (SimpleHelp, PDQ Connect, Fleetdeck, ScreenConnect) as delivery mechanisms
• Employs .URL shortcut files that trigger SMB requests for executables
• Runs a malware‑as‑a‑service model across multiple clusters
• Uses CastleRAT variants with remote command execution and self‑deletion
• Implements keylogging and clipboard logging
• Executes PowerShell scripts
• Conducts geolocation reconnaissance via ip‑api.com

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

UAC‑0241 has operated since mid‑2025 with a highly modular, scalable approach. Campaigns employ a malware‑as‑a‑service model that allows rapid redirection of phishing infrastructure through compromised freight‑matching sites and RMM tools. The actor’s tempo is moderate; campaigns are released in waves after collecting sufficient reconnaissance over targeted sectors. Victim profiling focuses on supply chain and transportation organizations due to their higher susceptibility to logistics-related lures, but the actor has also successfully penetrated governmental, educational, and healthcare institutions. Notable past operations include a May‑26 spear‑phishing attack that leveraged an emergency agency spoof, leading to lateral movement across Ukrainian education networks, and recent infiltration attempts in U.S. maritime firms via .URL shortcuts. The actor’s pattern shows consistent use of CastleLoader delivery combined with bespoke post‑exploitation modules for credential theft, data exfiltration, and command & control over HTTP/S.

IOC Patterns

• Spoofed email addresses mimicking logistics firms
• Malicious URLs hosted on Google Drive or .URL shortcut files pointing to SMB shares
• Compromised domains used for phishing delivery
• Domain names for IP geolocation services (e.g., ip-api.com)
• File names indicating keylogging activity (keylog.txt, clipboardlog.txt)
• DLL execution via rundll32
• PowerShell execution paths
• Domains such as Booking.com and derivative spam domains
• Suspicious IP addresses hosting command & control servers

Recommended Actions

• Implement DMARC, DKIM, and SPF to mitigate email spoofing by impersonated logistics firms.
• Deploy inbound email filtering rules for suspicious attachments (ZIPs with password) and links to known malicious URLs/domains.
• Block .URL shortcuts that initiate SMB traffic or download executable payloads; monitor SMB logs for anomalous shares.
• Enforce least privilege and MFA on all accounts, especially local admin and service accounts used by RMM tools.
• Segment networks around freight‑matching platforms to contain lateral movement.
• Maintain up-to-date antivirus/EDR capable of detecting CastleLoader, CASTLERAT, keylogging signatures and rundll32 abuse.
• Enable host-based monitoring for mshta → JavaScript → PowerShell execution chains. Provide targeted user awareness training on phishing emails that mimic booking or logistics communications.
• Patch systems to mitigate known CVEs (e.g., CVE‑2018‑0824) exploited by UnmarshalPwn.
• Block and quarantine incoming traffic to known malicious IPs such as 185.39.19.180/181, 15.197.240.20, 77.83.207.55, 178.17.57.103

Suggested Tags