Actor Profile

UAC-0099 is a Russia-aligned threat actor first documented by CERT-UA in June 2023, actively targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022 following Russia's full-scale invasion of Ukraine. Tracked by TrendAI as Earth Sirrush (previously SHADOW-EARTH-065), the group has been linked by ESET as a potential initial access broker for Sandworm, a Russian APT known for destructive attacks. UAC-0099 demonstrates continuous toolset evolution, transitioning from PowerShell and Go-based tools to compiled C# and .NET Reactor-protected binaries concealed in steganographic images, with parallel tool development under multiple developer accounts.

TTPs (Tactics, Techniques, Procedures)

UAC-0099 employs multiple initial access vectors including spearphishing with institutional impersonation (AnswerFromPolice lure mimicking National Police of Ukraine). Delivery mechanisms include DLL sideloading (FORGECLAMP technique), VHD containers, and custom .NET droppers. The group utilizes credential theft targeting Chrome and Firefox browsers, GDI-based screenshot capture, file enumeration and exfiltration, PowerShell remote shell execution (T1059.001), system fingerprinting via WMI, and encrypted C2 communications. ASHVEIN hides tasking in invisible HTML elements and some variants use GitHub-based dead drop resolvers as fallback C2. Defense evasion includes anti-VM checks, operating system installation date validation (aborting if OS is 10+ days older than execution date), .NET Reactor packing, and experimental GuardBreaker technique embedding LLM safety trigger prompts in VBScript to evade AI-assisted analysis. Persistence mechanisms are implemented through MATCHBOIL downloader variants.

Targets & Patterns

UAC-0099 primarily targets Ukrainian government personnel, defense organizations, border guard services, and logistics entities. Recent evidence indicates targeting expansion beyond government and military organizations to include civilian logistics and infrastructure operators supporting Ukraine's supply chain. This targeting pattern aligns with strategic intelligence collection requirements related to the ongoing Russia-Ukraine conflict, focusing on entities critical to Ukraine's governmental operations, defense capabilities, and logistical resilience. The use of decoy documents impersonating the National Police of Ukraine demonstrates tailored social engineering designed to exploit institutional trust and increase victim engagement rates within Ukrainian government circles.

Historical Context

UAC-0099 has demonstrated consistent operational tempo and toolset evolution since mid-2022. The malware arsenal progression shows: 2022-2024 deployment of LONEPAGE (PowerShell loader), THUMBCHOP (C# browser stealer), CLOGFLAG (keylogger), SEAGLOW, and OVERJAM (Go backdoors); 2024-2025 introduction of MATCHBOIL (C# loader under active development since April 2024), MATCHWOK (C# backdoor), and DRAGSTARE/NordDragonScan (C# infostealer); October 2025 first ASHVEIN compilation (five builds between October 8-23, 2025); February-April 2026 deployment of BadPaw/CINDERBLOT (.NET loader) and MeowMeow (backdoor); April-July 2026 use of LUNCHPOKE (Notepad++ plugin masquerade), BURNYBEAR (.NET loader), and MATCHBOIL.V2. ESET's November 2025 APT Activity Report linked UAC-0099 as potential initial access broker for Sandworm. The functional overlap between ASHVEIN and DRAGSTARE, combined with separate developer accounts (NordDragon vs. dev), indicates parallel tool development for operational redundancy.

Defensive Recommendations

  • Monitor for DLL sideloading activity (FORGECLAMP technique) by detecting unsigned or suspicious DLLs loaded by legitimate executables, particularly focusing on .NET applications and VHD container mounting behavior
  • Implement detection for PowerShell remote shell execution (T1059.001) via Sysmon Event ID 1 and PowerShell Script Block Logging (Event ID 4104), correlating with network connections to unknown external infrastructure
  • Deploy browser credential access monitoring for Chrome and Firefox profile directories, alerting on unauthorized process access to Login Data, logins.json, and key4.db files outside normal browser processes
  • Establish behavioral analytics for WMI fingerprinting activity and anti-VM checks, particularly processes querying Win32_ComputerSystem, Win32_BIOS, and OS installation date comparisons indicative of MATCHBOIL execution flow
  • Inspect GitHub and other code repository connections for dead drop resolver patterns, blocking unauthorized access to GitHub from sensitive systems and monitoring for encoded C2 configuration retrieval in HTML elements

---

# Geopolitical Context

Geopolitical Context

UAC-0099's deployment of ASHVEIN represents a continuation of Russia-aligned cyber espionage operations against Ukraine that intensified following the February 2022 full-scale invasion. The threat actor, which has been active since at least mid-2022, appears to function within a broader ecosystem of Russian cyber operations, with ESET reporting potential links to Sandworm—a well-documented Russian military intelligence (GRU) unit responsible for destructive attacks against Ukrainian critical infrastructure. The targeting of Ukrainian government, defense, border guard, and logistics entities is consistent with intelligence collection priorities that support ongoing military operations. The recent expansion to civilian logistics and infrastructure operators suggests operational requirements have evolved alongside the conflict, potentially reflecting Russian interest in supply chain disruption or pre-positioning for future effects operations. The sustained tool development—spanning PowerShell, Go, and increasingly sophisticated .NET malware families—indicates dedicated resourcing and operational continuity over a multi-year campaign.

State Actor Alignment

UAC-0099 is assessed by Ukrainian CERT-UA and multiple threat intelligence vendors as Russia-aligned. ESET reporting from November 2025 indicates the group may serve as an initial access broker for Sandworm (also tracked as Voodoo Bear, IRIDIUM), a threat actor attributed by the U.S., UK, and EU governments to Russia's Main Intelligence Directorate (GRU) Unit 74455. This relationship, if confirmed, would place UAC-0099 within the operational framework of Russian state-sponsored cyber activity. The targeting pattern—focused exclusively on Ukrainian government, military, and logistics entities since mid-2022—aligns with Russian strategic intelligence requirements during the ongoing conflict. No public sanctions designations specific to UAC-0099 have been identified, though Sandworm has been subject to U.S. Treasury (OFAC) and EU sanctions since 2020.

Business Impacty pro region

The campaign's primary impact remains concentrated in Ukraine, where persistent targeting of government personnel and expanding focus on civilian logistics threatens operational security across multiple sectors critical to national defense and economic resilience. For European partners providing military and humanitarian assistance to Ukraine, the targeting of logistics operators may indicate Russian interest in mapping supply routes and identifying interdiction opportunities. The use of social engineering lures impersonating Ukrainian law enforcement (National Police) demonstrates operational familiarity with Ukrainian institutional structures and suggests potential for similar techniques against regional partners. NATO member states with significant Ukraine support roles—particularly Poland, Romania, and the Baltic states—should anticipate spillover risk if UAC-0099's mandate expands to transnational logistics networks. The threat actor's experimentation with AI evasion techniques (GuardBreaker) signals awareness of evolving defensive capabilities and may foreshadow broader adoption of LLM-targeted obfuscation across Russian-aligned groups, complicating automated threat analysis for defenders globally.

Forecast

If UAC-0099 continues to operate as an initial access broker for Sandworm, Ukrainian targets that experience ASHVEIN infections may face elevated risk of follow-on destructive attacks, particularly against logistics and infrastructure operators newly within the threat actor's aperture. The steady cadence of tool development—with five ASHVEIN builds compiled within a 15-day window in October 2025 and multiple malware family updates through mid-2026—suggests sustained operational tempo is likely to persist in the near term. If the conflict remains stalemated or escalates, targeting may expand further to include European logistics hubs and transportation networks supporting Ukrainian supply lines. The brief experimentation with GuardBreaker techniques, even if currently abandoned, indicates UAC-0099 is monitoring defensive AI adoption; if LLM-based security tools gain wider deployment, similar evasion methods may re-emerge. Organizations in Ukraine's government, defense, and logistics sectors should anticipate continued spearphishing campaigns using institutional impersonation, with delivery methods likely to rotate among DLL sideloading, VHD containers, and .NET droppers to evade signature-based detection.