Cyber Serp

Executive Summary

Cyber Serp (also known as UAC‑0255 and linked to a larger family of APT29-like actors) is a sophisticated cyber‑espionage outfit that specializes in high‑profile spear‑phishing campaigns. By masquerading as Ukrainian CERT notices and using password‑protected ZIP archives hosted on Files.fm, it delivers the Go‑based RAT AGEWHEEZE along with ancillary downloaders such as IRONHALO and ELMER. The group employs advanced persistence mechanisms, a WebSocket C2 over port 8443 on OVH servers, and exploits CVE‑2015‑1701 to secure long‑term access for extensive data exfiltration.

Goals & Targeting

The actor’s overarching goal is long‑term espionage against state‑sponsored entities within the defense, diplomacy, and strategic sectors. By leveraging trusted identifiers (CERT UA branding) and low‑profile delivery mechanisms (Files.fm archives), Cyber Serp seeks to infiltrate privileged networks for sustained data exfiltration. Strategic targeting prioritizes national security organizations in the U.S., EU countries, and regional powers such as Russia, Iran, and China, reflecting a focus on geopolitical adversaries and allies of their sponsors.

Key Capabilities

• Spear‑phishing with password‑protected ZIP attachments
• Impersonation of official CERT‑UA brand to build credibility
• Hosting malicious archives on Files.fm service
• Distribution of Go‑based RAT AGEWHEEZE via IRONHALO or ELMER backdoors
• Command and Control via WebSocket channel on port 8443
• Persistence through scheduled tasks, registry changes, and startup folder placement
• Exploitation of Microsoft Word use‑after‑free vulnerability and CVE‑2015‑1701 for privilege escalation
• Obfuscated files to evade detection
• Ingress tool transfer over the C2 network
• Monitoring user activity (screenshots, clipboard, keystrokes)
• Rapid noisy break‑ins followed by large‑scale data exfiltration
• Long‑term persistent compromise for intelligence gathering

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Cyber Serp’s campaigns exhibit a high‑frequency, low‑profile approach that begins with an enticing spear‑phishing attachment. After initial compromise, the actor rapidly harvests data and optionally installs additional backdoors to maintain long‑term access. Their operations have spanned multiple continents, targeting governmental, defense, financial, legal, aerospace, maritime, and energy sectors. Past high‑profile incidents include the UAC‑0255 phishing campaign directed at Ukrainian public and private organizations, as well as historical ties to APT29’s ‘Duke’ malware family used against U.S. government entities in 2015.

IOC Patterns

• Domain names hosted on OVH servers (e.g., example.com)
• Outbound HTTPS traffic over port 8443 with self‑signed certificates containing Organization field "TVisor"
• Password‑protected ZIP attachments from Files.fm
• Web page titled "The Cult" on the C2 server
• Spear‑phishing emails with malicious attachment
• Watering hole URLs used for initial delivery
• Sample domains: demo-cloud.space, cisa.gov, TEMP.Hermit, TEMP.Veles, Cyber.Anarchy.Squad

Recommended Actions

• Deploy email filtering and sandboxing tailored to detect spear‑phishing attachments
• Implement a policy that restricts or monitors password‑protected archives in emails
• Flag outbound HTTPS traffic on port 8443 especially towards OVH domains for deeper inspection
• Scrutinize self‑signed certificates with unusual Organization fields and treat them as suspicious
• Keep systems patched against CVE‑2015‑1701 and Microsoft Word use‑after‑free (EPS dictionary) vulnerabilities
• Enable multi‑factor authentication for all privileged accounts
• Monitor file creation in startup folders, scheduled task registry entries, and WebSocket connections to foreign hosts
• Apply web application firewalls and DNS monitoring to detect watering hole compromises

Suggested Tags