[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnXUr71o7zHBcGW4h2R8clT5j_lwV94tpjnSa9A4EBQM":3},{"article":4,"iocs":49,"watch_terms":101,"solutions":102,"lesson":186},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4276dd26-326b-4218-8d2d-ce32cb9d914d","UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML","uac-0099-targets-ukrainian-government-personnel-with-ashvein-rat-hiding-commands-7624a7","The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065). ASHVEIN,","The Russia-aligned threat actor UAC-0099, also known as Earth Sirrush, is using a new .NET infostealer and RAT called ASHVEIN to target Ukrainian government personnel. ASHVEIN, internally referred to as 'TelemetryBrowser,' offers credential theft, surveillance, and remote control capabilities, with commands hidden in HTML elements. Delivery methods include DLL sideloading, VHD containers, and .NET droppers, often using institutional impersonation.","Russia-aligned UAC-0099 uses new ASHVEIN RAT to target Ukrainian government personnel.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fuac-0099-targets-ukrainian-government.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjZWPW7zD0DZUCKyeRcD-sBZtZ28n4PPaJDPjiskf9ghOI7b3aYbYCEbNvITxaYjCkejq8Vfuc0xeZtJ7p2R4j4dEqGXwfb1JLqQVHrgE4uxdSCq-JJgAeLA0WZbz5Fi98LQbxr3ncRXodrBd83xaX2UpXtDb-Q55ryWBPeXGAQlDBykN_BYecleld5rxJM\u002Fs1600\u002Fuk.jpg","2026-10-08T15:26:56+00:00","2026-10-08T16:00:11.298445+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"UAC-0099","threat_actor",{"name":21,"type":19},"Earth Sirrush",{"name":23,"type":19},"SHADOW-EARTH-065",{"name":25,"type":19},"Sandworm",{"name":27,"type":28},"ASHVEIN","product",{"name":30,"type":28},"TelemetryBrowser","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,52,54,57,60,63,66,69,72,75,78,81,84,87,90,93,95,98],{"type":35,"value":27,"context":51},"New .NET infostealer and RAT used by UAC-0099.",{"type":35,"value":30,"context":53},"Internal name for ASHVEIN RAT.",{"type":35,"value":55,"context":56},"LONEPAGE","PowerShell-based loader used by UAC-0099.",{"type":35,"value":58,"context":59},"THUMBCHOP","C#-based browser stealer used by UAC-0099.",{"type":35,"value":61,"context":62},"CLOGFLAG","Keylogger used by UAC-0099.",{"type":35,"value":64,"context":65},"SEAGLOW","Go-based backdoor used by UAC-0099.",{"type":35,"value":67,"context":68},"OVERJAM","Go-based reverse-proxy backdoor used by UAC-0099.",{"type":35,"value":70,"context":71},"MATCHBOIL","C#-based loader used by UAC-0099.",{"type":35,"value":73,"context":74},"MATCHWOK","C#-based backdoor used by UAC-0099.",{"type":35,"value":76,"context":77},"DRAGSTARE","C#-based information stealer used by UAC-0099.",{"type":35,"value":79,"context":80},"NordDragonScan","Alternative name for DRAGSTARE.",{"type":35,"value":82,"context":83},"BadPaw",".NET-based loader used by UAC-0099.",{"type":35,"value":85,"context":86},"CINDERBLOT","Alternative name for BadPaw.",{"type":35,"value":88,"context":89},"MeowMeow","Backdoor used by UAC-0099.",{"type":35,"value":91,"context":92},"LUNCHPOKE",".NET DLL masquerading as Notepad++ plugin.",{"type":35,"value":94,"context":83},"BURNYBEAR",{"type":35,"value":96,"context":97},"FORGECLAMP","Alias for DLL sideloading delivery method.",{"type":35,"value":99,"context":100},"AnswerFromPolice",".NET executable dropper used by UAC-0099.",[27,30],{"controls":103,"vendors":185},[104,133,159],{"slug":105,"name":106,"problem":107,"products":108},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":134,"name":135,"problem":136,"products":137},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[138,146,154],{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":155,"product_name":156,"url":157,"description":158},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":160,"name":161,"problem":162,"products":163},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[164,172,177],{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":173,"product_name":174,"url":175,"description":176},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":178,"vendor_name":179,"vendor_logo":180,"product_slug":181,"product_name":182,"url":183,"description":184},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":187,"title":188,"body":189,"framework_refs":190,"framework_notes":203},"ashvein-rat-targets-ukrainian-officials-via-html-concealed-commands-and-institutional-impersonation","ASHVEIN RAT Targets Ukrainian Officials via HTML-Concealed Commands and Institutional Impersonation","UAC-0099 is deploying a sophisticated .NET-based RAT called ASHVEIN against Ukrainian government personnel, leveraging institutional impersonation to trick users into executing malicious payloads delivered via DLL sideloading, VHD containers, and .NET droppers. The threat actor hides command-and-control instructions inside HTML elements, making traffic analysis and detection significantly harder for defenders. This campaign highlights how social engineering combined with technical obfuscation can bypass traditional email and endpoint defenses. Government personnel handling sensitive data are high-value targets, meaning credential theft and remote access can have cascading consequences for national security. Without strong user awareness, endpoint visibility, and strict application controls, such intrusions may go undetected for extended periods.",[191,192,193,194,195,196,197,198,199,200,201,202],"CIS Control 2 - Inventory and Control of Software Assets","CIS Control 9 - Email and Web Browser Protections","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-53 SI-3 - Malicious Code Protection","NIST SP 800-53 AC-4 - Information Flow Enforcement","NIST SP 800-53 AT-2 - Security Awareness Training","NIST SP 800-53 AU-12 - Audit Record Generation","MITRE ATT&CK T1574.002 - DLL Side-Loading","MITRE ATT&CK T1566 - Phishing","MITRE ATT&CK T1027 - Obfuscated Files or Information","NIST CSF DE.CM-1 - Network Monitoring","ITIL - Threat and Risk Management",{"MITRE ATT&CK T1566 - Phishing":204,"ITIL - Threat and Risk Management":205,"NIST CSF DE.CM-1 - Network Monitoring":206,"MITRE ATT&CK T1574.002 - DLL Side-Loading":207,"NIST SP 800-53 AU-12 - Audit Record Generation":208,"CIS Control 13 - Network Monitoring and Defense":209,"NIST SP 800-53 SI-3 - Malicious Code Protection":210,"CIS Control 9 - Email and Web Browser Protections":211,"NIST SP 800-53 AT-2 - Security Awareness Training":212,"NIST SP 800-53 AC-4 - Information Flow Enforcement":213,"MITRE ATT&CK T1027 - Obfuscated Files or Information":214,"CIS Control 2 - Inventory and Control of Software Assets":215},"Phishing with institutional impersonation is the entry point, which training and filtering target.","Threat and risk management helps prioritise defences against targeted espionage.","Network monitoring helps detect hidden command and control channels.","DLL sideloading lets ASHVEIN run through legitimate programs, so monitoring DLL loads is key.","Audit record generation supports detecting DLL sideloading and unusual process activity.","Network monitoring can detect ASHVEIN command traffic hidden in HTML content.","Malicious code protection helps detect .NET droppers and RATs like ASHVEIN.","Email and browser protections can block VHD and other container attachments used for delivery.","Awareness training helps officials recognise institutional impersonation lures.","Information flow enforcement can restrict outbound traffic used for command and control.","Obfuscation hides commands in HTML, requiring deeper inspection to detect.","A software inventory helps detect unexpected .NET binaries and VHD-delivered payloads like ASHVEIN."]