10.8.2026 CERT UA BATTLEFIELD UKRAINE
General information
The Ukrainian government's computer emergency response team, CERT-UA, has been monitoring targeted activity for the purpose of espionage against centers of innovation development in the military sector, military formations, Ukrainian law enforcement agencies, and local governments, especially those located along the country's eastern border, since February 2025.
The initial compromise is achieved by distributing emails with attachments in the form of XLS documents with macros (extension ".xlsm"), the names/topics of which may relate to issues of demining the territory, administrative fines, UAV production, compensation for destroyed property, etc. In this case, the "payload" is presented in the form of base64-encoded strings stored in Excel spreadsheet cells. The mentioned macro provides conversion (decoding) of base64-encoded strings into executable files, their saving to the computer without extension (!) and subsequent launch.
As of April 2025, two types of software tools for implementing the cyber threat are known. The first is a .NET program, the resources of which contain a PowerShell script, which is functionally a reverse-shell borrowed from the public GitHub repository PSSW100AVB. The second, classified as GIFTEDCROOK, is a C/C++ stealer program that, among other things, provides access to the databases of Internet browsers Chrome, Edge, Firefox (Cookies, history, saved authentication data), their archiving using the PowerShell cmdlet Compress-Archive, and subsequent exfiltration to Telegram.
The described cyber threat cluster is tracked by the identifier UAC-0226.
Thanks to the coordinated work of cyber defense entities, in particular, the prompt exchange of information, effective response measures are taken for each of the similar cyber incidents of CERT-UA. In case of detection of signs of cyber attacks, please inform us immediately by any of the available means of communication.
Please note that emails are being sent using compromised accounts, including via the web interface. In this regard, we ask system administrators to separately check the availability, completeness, and depth of mail and web server logs.
Cyber threat indicators
Files:
(28.02.2025) 4a2ec9f72b910c0a8e3efc4c334f5bad f8a31715840852e8ef04016b31f909123f2aa864f3850c45eb511fd1885b4037 28_02.2025.xlsm e5f4188682e40e79800ccd165289c844 e852d254395ef04308bcde37c3ee9725ab23ca82a202e7d69028c8bee0f0d05f Microsoft OneDrive Assistant 1b71d870f34587e0a2717f9925086eab a2f651d39b8d97221ad36577e9b50beabdf0ad46aec0c29b6cff624e1e2ffd0c kpbkewf32mm.ps1 (26.03.2025) 333b09f8865aae5d257b6f11f2fe5d08 a02506468e632875a2c9c9c16e730b8bdc52f7450b28ee7bd8f5ac014b264e53 Compensation for destroyed property.xlsm b3831f0bace886aaba81873edc20aba4 40e68d7240e692ef3301cfaa92a04e0af65f2d725cbfa6711c3154b627fec0f1 Administrative fines of employees of the organization 921867.xlsm 100cd9d907e986ba8d5fc6d0488557d9 58b38775f655498b134ce8cd52ab0aba05b710f7611e41cbdffdc3597c5d5f3d - 8b694068e5088e0c32739956e28b077e 8427dc6e7da4c163d20c7f188232cf3f83c78ddb6fcad04cec84b33e0f9bdfc0 Windows Service (GIFTEDCROOK) 0a178f76c48c038e8bad03a62b52cfc9 78ea83bfbca85a39e59fa35c8f704873f3fdad3a5278430e75286247530042b8 Windows Telemetry 671b42e854ae2ee3341456fbec7c7787 92183f89b115881535b1bf1985f3ee4b4ebf077bec8cc4de0c6c6e266da0cb87 nnnnrth.ps1 (04/02/2025) 3394fc2ba0a976818691751aa7f86d05 0a4777725673f9f7114ddceddd80e5a72ad3a4d20fd2014d4c60e2cc1a6cefc2 Action Defender ARMY (2).xlsm d280a258704bf9155bceaf4f731988ea 7ca3f2505e1778e6de3927571ba49d27b36447e6c28a60161d55fd2254966bce Svchost (GIFTEDCROOK) daffbfd71f8595ab6d6b8c94cc81a778 24a60e50ed8469fc31afa9abfc361291f72922430cf062bf9c4ac7e6d84b5fad Administrative fines 31.03 of employees of the organization 1744269.xlsm 037e2ca3c97e1a5645cdc45fb0d98064 2930ad9be3fec3ede8f49cecd33505132200d9c0ce67221d0b786739f42db18a Runtime (GIFTEDCROOK) (04.04.2025) cffdd24742610fe5710dbc9ebd258c64 c8bb0dbc952c9dc2bbc550a300ed033ad5d2416390891ed1e800b08ad3ab5d3a Administrative fines of the organization 51324.xlsm f62ea2cbd220596072010e91dd65b673 530185fac69e756fb62f23e21e7c0b0828a964b91bbf40f1d04fc2136c1b6dd1 SysAnalyzer (GIFTEDCROOK) 9f6c82c240ba5ef6bb85d28c0cdf7f7f c27cf714293c496c8fc05b330a57bcfcb6189267e2818062660de88b0f3a25cd Administrative fines of employees of the organization 291081.xlsm b63b783a9aca15726babd599d2963869 ff1be55fb5bb3b37d2e54adfbe7f4fbba4caa049fad665c8619cf0666090748a ServiceHub (GIFTEDCROOK) (07.04.2025) 966373dbe28f4111f6ce47038fb343da 8a638a788adb0edb6622b16fd8783bc225470f8ff94b1bba4a94b4d8c105acef Administrative fines for employees of the organization 90482.xlsm 9c03d0da190d1046583ba9fa83a8bcd3 d7a66fd37e282d4722d53d31f7ba8ecdabc2e5f6910ba15290393d9a2f371997 FlashAssistant (GIFTEDCROOK)
Host:
%PROGRAMDATA%\Microsoft OneDrive Assistant\Microsoft OneDrive Assistant %PROGRAMDATA%\Windows Service\Windows Service %PROGRAMDATA%\Windows Telemetry\Windows Telemetry %PROGRAMDATA%\Microsoft Runtime\Runtime %PROGRAMDATA%\Svchost\Svchost %PROGRAMDATA%\Microsoft ServiceHub\ServiceHub %PROGRAMDATA%\SysAnalyzer\SysAnalyzer %PROGRAMDATA%\FlashAssistant\FlashAssistant %TMP%\nmpoyqv5l0ig\ %TMP%\status.zip powershell -Command Compress-Archive -Path %TMP%\nmpoyqv5l0ig\* -DestinationPath %TMP%\status.zip
Network:
149[.]102.246.110 (VPN; 2025-02-28 00:00:22+0200 - 2025-02-28 16:10:29+0200) (tcp)://37[.]120.239.187:6501 37[.]120.239.187 (C2) (tcp)://89[.]44.9.186:3240 89[.]44.9.186 (C2)
Graphic images
Fig.1 Example of a chain of attack (GIFTEDCROOK)
Fig.2 Examples of emails and reverse-shell