UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 uses new ASHVEIN RAT to target Ukrainian government personnel.
The Russia-aligned threat actor UAC-0099, also known as Earth Sirrush, is using a new .NET infostealer and RAT called ASHVEIN to target Ukrainian government personnel. ASHVEIN, internally referred to as 'TelemetryBrowser,' offers credential theft, surveillance, and remote control capabilities, with commands hidden in HTML elements. Delivery methods include DLL sideloading, VHD containers, and .NET droppers, often using institutional impersonation.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ASHVEIN?
Get an email when a new story names ASHVEIN, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonUAC-0099 is deploying a sophisticated .NET-based RAT called ASHVEIN against Ukrainian government personnel, leveraging institutional impersonation to trick users into executing malicious payloads delivered via DLL sideloading, VHD containers, and .NET droppers. The threat actor hides command-and-control instructions inside HTML elements, making traffic analysis and detection significantly harder for defenders. This campaign highlights how social engineering combined with technical obfuscation can bypass traditional email and endpoint defenses. Government personnel handling sensitive data are high-value targets, meaning credential theft and remote access can have cascading consequences for national security. Without strong user awareness, endpoint visibility, and strict application controls, such intrusions may go undetected for extended periods.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ASHVEIN
- malware — TelemetryBrowser
- malware — LONEPAGE
- malware — THUMBCHOP
- malware — CLOGFLAG
- malware — SEAGLOW
- malware — OVERJAM
- malware — MATCHBOIL
- malware — MATCHWOK
- malware — DRAGSTARE
- malware — NordDragonScan
- malware — BadPaw
- malware — CINDERBLOT
- malware — MeowMeow
- malware — LUNCHPOKE
- malware — BURNYBEAR
- malware — FORGECLAMP
- malware — AnswerFromPolice