|
UKRAINE |
 |
VS |
|
RUSSIA |
|
DATE |
NAME |
INFO |
CATEGORY |
SUBCATE |
|
5.10.26 |
UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER |
In September 2026, CERT-UA specialists discovered over 100 compromised websites to which malicious JavaScript code had been added by attackers. When visiting such a site, the user was shown a fake Cloudflare verification page, which, under the pretext of confirming that the visitor was a human, offered to execute a command. Executing the command resulted in downloading and installing an MSI package from a remote server (ClickFix technique). | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 30.9.26 | Social engineering performed by UAC-0145: compromising in the employment process | CERT-UA has received information about the use of advanced social engineering methods by the cyber threat cluster UAC-0145 (subcluster UAC-0002, also known as Sandworm, APT44, Seashell Blizzard). In particular, on job search sites, attackers, having previously studied the candidate's resume, contact a potential victim, usually a system administrator/IT specialist, on behalf of an IT company (for example, ATLAS Business Group). | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
|
10.8.26 |
UAC-0099: LUNCHPOKE, BURNYBEAR, updated to MATCHBOIL.V2 and using Notepad++ 8.8.3 |
Since mid-summer 2026, CERT-UA has noted a change in the tactics, techniques, and procedures of the UAC-0099 cyberthreat cluster. In particular, the fact of launching a software tool for implementing cyberthreats in the form of a DLL file disguised as a plugin called "NppExport.dll" was documented, using a legitimate Notepad++ 8.8.3 program file delivered to the computer in the form of an archive with other standard software components. |
BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 15.7.26 | UAC-0145 Primary Compromise Vectors as of July 2026 | For a long time, CERT-UA, in cooperation with the main entities providing cybersecurity in Ukraine, has been carrying out targeted activities to study the UAC-0145 cyber threat cluster (UAC-0002 subcluster, also known as Sandworm, APT44, Seashell Blizzard). | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 21.5.26 | Updated UAC-0057 toolkit: OYSTERFRESH, OYSTERSHUCK and OYSTERBLUES |
Since spring 2026, CERT-UA has recorded numerous cases of sending emails to government organizations using compromised accounts, in particular using the topic of obtaining certificates through the online platform Prometheus.Typically, an email attachment contains a PDF document with a link that downloads a ZIP archive containing a JS file. |
BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
|
15.4.26 |
Hospitals, local governments, and FPV operators are in the focus of the UAC-0247 (UAC-0244) cyber threat cluster | CERT-UA would like to draw the community's attention to the fact that the activity described in this article as a separate cyber threat cluster UAC-0247 is actually carried out by individuals whose activities were previously tracked under the identifier UAC-0244. Therefore, further tracking of related campaigns will be carried out under the identifier UAC-0244. | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 2.3.26 | UAC-0255 cyberattack disguised as a notification from CERT-UA using the AGEWHEEZE software tool (CERT-UA#21075) | The National Cyber Incident, Cyber Attack, and Cyber Threat Response Team CERT-UA recorded cases of distribution of emails allegedly on behalf of CERT-UA on March 26-27, 2026, urging people to download a password-protected archive ("CERT_UA_protection_tool.zip", "protection_tool.zip") from the Files.fm service and install "specialized software". Among the recipients of the emails: government organizations, medical centers, security companies, educational institutions, financial institutions, software development companies, and others. | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 3.2.26 | UAC-0252 cyberattacks using SHADOWSNIFF and SALATSTEALER stealers (CERT-UA#20032) | Since January 2026, CERT-UA has recorded frequent cases of distribution of emails, allegedly on behalf of central executive authorities and regional administrations, calling for updating mobile applications of widely used civilian and military systems. | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 2.1.26 | "Danger Bulletin": UAC-0001 (APT28) carries out cyberattacks against Ukraine and EU countries using the CVE-2026-21509 exploit (CERT-UA#19542) |
On Monday, January 26, 2026, Microsoft published information about a vulnerability with the identifier CVE-2026-21509 in Microsoft Office products, with a note about the active exploitation of the latter.Already on 01/29/2026, a DOC file "Consultation_Topics_Ukraine(Final).doc" was discovered in the public domain, containing an exploit for the aforementioned vulnerability and was dedicated to the consultations of the Committee of Permanent Representatives to the EU (COREPER) on the situation in Ukraine. |
BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
| 12.1.26 | "Untrustworthy Fund": targeted UAC-0190 cyberattacks against SOU using PLUGGYAPE (CERT-UA#19092) | During October-December 2025, the National Cyber Incident Response Team, Cyber Attacks, and Cyber Threats CERT-UA, in cooperation with the Cyber Incident Response Team of the Armed Forces of Ukraine (military unit A0334), took measures to investigate a number of targeted cyber attacks against representatives of the Defense Forces of Ukraine, carried out under the guise of charitable foundation activities using the PLUGGYAPE software tool. | BATTLEFIELD UKRAINE | BATTLEFIELD UKRAINE |
