{"id":3441,"date":"2026-10-08T15:33:56","date_gmt":"2026-10-08T15:33:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3441"},"modified":"2026-10-08T15:33:56","modified_gmt":"2026-10-08T15:33:56","slug":"uac-0099-targets-ukrainian-government-personnel-with-ashvein-rat-hiding-commands-in-html","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3441","title":{"rendered":"UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML"},"content":{"rendered":"
\n
<\/a><\/div>\n

The Russia-aligned threat actor known as UAC-0099<\/strong> has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN<\/strong>.<\/p>\n

According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush<\/strong> (previously SHADOW-EARTH-065).<\/p>\n

ASHVEIN, which its developers internally refer to as \u00abTelemetryBrowser,\u00bb brings together credential theft, surveillance, and remote-control capabilities. Its functionality includes credential theft from Chrome and Firefox, GDI-based screenshot capture, file enumeration and retrieval, PowerShell remote shell execution, system fingerprinting, and encrypted command-and-control (C2) communications.<\/p>\n

\u00abASHVEIN also hides tasking inside invisible HTML elements,\u00bb TrendAI said<\/a>. \u00abSome variants use a GitHub-based dead drop resolver as a fallback mechanism, while delivery methods include DLL sideloading, VHD containers, and dedicated .NET droppers.\u00bb<\/p>\n

UAC-0099 was first documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in June 2023. It has a history of targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022, emerging in the wake of Russia’s full-scale invasion of Ukraine.<\/p>\n

ESET, in its APT Activity Report published in November 2025, said the cyber espionage crew can serve as an initial access broker for Sandworm, a Russian advanced persistent threat (APT) group best known for its destructive attacks against Ukraine.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In the intervening time period, the threat actor has steadily expanded its malware arsenal, while shifting from PowerShell- and Go-based tools to compiled C# and .NET Reactor-protected binaries concealed within steganographic image files.<\/p>\n

Some of the malware families deployed by the threat actor over the years are listed below –<\/p>\n