Урядова команда реагування на комп’ютерні надзвичайні події України, яка функціонує в складі Державної служби спеціального зв’язку та захисту інформації України.

Detect UAC-0099 attacks against Ukraine using MATCHBOIL, MATCHWOK, and DRAGSTARE malware with curated Sigma rules from SOC Prime Platform.

UAC-0099 delivers malware via a fake Notepad++ plugin, using a loader that sabotages itself if run without the correct arguments.

🚨 Security Alert: Notepad++ is being weaponized by hackers to silently install malware on Windows machines. The UAC-0099 threat group is using a legitimate Notepad++ 8.8.3 executable to sideload mali

Hackers have been sending fake summons emails purportedly from Ukrainian courts to target the country’s military and defense, cyber authorities have found.

Ukraine's CERT-UA warns of phishing attacks by UAC-0099 targeting defense sectors, using malware like MATCHBOIL, MATCHWOK, and DRAGSTARE.

Ukraine’s CERT-UA warns of phishing attacks by UAC-0099 targeting defense sectors, using malware like MATCHBOIL, MATCHWOK, and DRAGSTARE. Ukraine’s CERT-UA warns of phishing attacks by threat actor UAC-0099 targeting government and defense sectors, delivering malware like MATCHBOIL and DRAGSTARE. The National Cyber Incident, Cyber Attack, and Cyber Threat Response Team CERT-UA investigated multiple attacks against […]

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks carried out by a threat actor called UAC-0099 targeting government agencies, the defense forces, and enterprises of the defense-industrial complex in the country. The attacks, which leverage phishing emails as an initial compromise vector, are used to deliver malware families like MATCHBOIL, MATCHWOK, and

In a relentless wave of cyberattacks, the Ukrainian National Cybersecurity team CERT-UA has uncovered a highly sophisticated phishing campaign targeting government agencies, military forces, and defense industry enterprises. The threat actor behind this campaign, known as UAC-0099, is employing advanced malware strains such as MATCHBOIL, MATCHWOK, and DRAGSTARE to infiltrate and maintain persistent control over critical systems. This operation not only underscores the rising cyber warfare tensions in the ongoing Ukraine conflict but also highlights the evolving complexity of modern cyber threats aimed at state-level targets.

CERT-UA has warned of cyber attacks by UAC-0099 targeting Ukrainian government and defense sectors. The attacks use phishing emails with malicious HTA files disguised as court summons. These HTA files execute C# scripts to deploy malware like MATCHBOIL and MATCHWOK. HTA files are dangerous as they run with user-level permissions, making them effective for malware delivery. The use of C# scripts adds complexity to detection efforts. The targeting of government and defense entities suggests potential state sponsorship. These attacks highlight the evolving tactics of threat actors, emphasizing the need for robust email security, endpoint protection, and user awareness training. Organizations should monitor for unusual C# script executions and implement systems to detect and block malicious HTA files.

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning about a series of phishing attacks conducted by the threat actor UAC-0099. These attacks are targeting government and defense sectors in Ukraine, utilizing custom malware strains such as MATCHBOIL, MATCHWOK, and DRAGSTARE. According to the report, UAC-0099 has been observed using phishing emails to deliver malicious payloads. The malware strains mentioned are designed for various malicious activities, including data exfiltration and remote access. MATCHBOIL, for instance, is known for its ability to evade detection by traditional antivirus solutions, while DRAGSTARE is often used for lateral movement within a compromised network. The technical implications of these attacks are significant. The use of phishing as an initial access vector highlights the importance of robust email security measures. Organizations should prioritize employee training on recognizing phishing attempts, implement multi-factor authentication, and deploy advanced threat detection systems. The impact on the cybersecurity landscape is profound. These attacks are part of a broader pattern of cyber warfare between Russia and Ukraine, with state-sponsored actors continuously evolving their tactics. For cybersecurity professionals, this underscores the importance of continuous monitoring and threat intelligence sharing. In conclusion, the UAC-0099 phishing attacks targeting Ukraine's defense sector are a stark reminder of the persistent and evolving threats in the cyber domain. Cybersecurity professionals must remain vigilant and proactive in their defense strategies.

Ukraine's CERT-UA warns of phishing attacks by UAC-0099 targeting defense sectors, using malware like MATCHBOIL, MATCHWOK, and DRAGSTARE.