UAC-0099 Targets Ukrainian Officials With New ASHVEIN RAT and .NET Infostealer
Analysis reveals a Russia-aligned group using the previously undocumented ASHVEIN malware to compromise Ukrainian government personnel, hiding commands in HTML.
Key points
- UAC-0099 is attributed to the new ASHVEIN RAT and a .NET infostealer.
- TrendAI tracks the cluster under the name Earth Sirrush.
- The malware targets Ukrainian government personnel and hides commands in HTML.
A Russia-aligned threat actor identified as UAC-0099 is deploying a previously undocumented remote access trojan (RAT) and infostealer against Ukrainian government personnel. According to The Hacker News, the campaign utilizes malware codenamed ASHVEIN, which has been linked to this specific cluster of activity.
The cybersecurity firm TrendAI has been tracking this threat cluster under the operational name Earth Sirrush. Previously, the group was known as SHADOW-EARTH-065. The attribution connects UAC-0099 to the development and deployment of ASHVEIN, marking a significant addition to the actor's toolkit. The malware includes both remote access capabilities and information-stealing components, providing the attackers with persistent control over compromised systems.
Technical Overview of ASHVEIN
ASHVEIN is a .NET-based malware family that combines remote access trojan functionalities with infostealer capabilities. According to The Hacker News, the malware is designed to evade detection by hiding its commands within HTML structures. This obfuscation technique allows the threat actor to maintain communication with compromised endpoints while avoiding traditional signature-based detection methods.
The use of .NET for the infostealer component suggests a reliance on widely available development frameworks, which can complicate forensic analysis. The combination of a RAT and an infostealer in a single campaign indicates a sophisticated approach to espionage, allowing UAC-0099 to both harvest sensitive data and execute arbitrary commands on victim machines. The specific mechanisms by which the commands are hidden in HTML were detailed in the analysis provided by TrendAI, as reported by The Hacker News.
Who Is Affected
The primary targets of this campaign are Ukrainian government personnel. According to The Hacker News, TrendAI has observed the malware being actively used in attacks directed at this specific group. The focus on government officials suggests an espionage motive, aiming to gain access to sensitive state information or disrupt governmental operations.
The attribution of this activity to UAC-0099, a Russia-aligned threat actor, aligns with broader patterns of cyber operations targeting Ukraine. The shift to a new, undocumented malware family like ASHVEIN may indicate an effort to bypass existing security measures that have been tuned to detect previous tools used by the group. The rebranding of the cluster from SHADOW-EARTH-065 to Earth Sirrush also reflects the evolving nature of the threat actor's operational security.
What should you do?
No patch or specific fix for the ASHVEIN malware has been confirmed in the source material. Security professionals should monitor for indicators of compromise associated with the Earth Sirrush cluster. Organizations, particularly those in the government sector, should review network traffic for unusual HTML-based command structures that may indicate the presence of the RAT. Incident response teams should investigate any suspicious .NET processes that exhibit remote access behavior.
Frequently asked questions
What is the name of the new malware used by UAC-0099?
The malware is codenamed ASHVEIN, which includes both a remote access trojan and a .NET infostealer.
Who is tracking the Earth Sirrush cluster?
The cybersecurity company TrendAI is tracking the cluster, previously known as SHADOW-EARTH-065.
Who are the targets of this campaign?
The attacks are targeting Ukrainian government personnel, according to The Hacker News.
