Loading threat actor…
UAC-0006 is a financially motivated threat actor active since at least 2013 that primarily targets Ukrainian organizations, with a recurring focus on accountants’ workstations, banking users, and financial institutions. The cluster is closely associated with phishing-led delivery of SmokeLoader and has repeatedly used invoice, payment, court, and other business-themed lures to induce execution of malicious attachments or archives. Reported delivery chains include password-protected and nested archives, VBS, JavaScript, LNK, IMG, and Microsoft Access macro-enabled files, as well as exploitation of CVE-2025-0411 in 7-Zip to bypass Mark-of-the-Web protections and deploy SmokeLoader. Operations attributed to UAC-0006 have targeted Ukrainian government entities, financial institutions and customers, energy-sector organizations, and other public- and private-sector victims. Campaigns have included phishing against customers of PrivatBank and broader attacks against Ukrainian entities using compromised email accounts and evasive attachment formats. CERT-UA reporting has linked the actor’s activity to anticipated or ongoing fraud involving remote banking systems, and multiple assessments describe the group as engaged in theft of funds from individuals and legal entities. SmokeLoader is the actor’s hallmark malware, but post-compromise activity has also involved follow-on payloads such as TALESHOT and RMS. Observed tradecraft includes phishing for initial access, use of command and scripting interpreters including PowerShell and VBS, process injection, masquerading, ingress tool transfer, use of legitimate system binaries, and command-and-control over application-layer protocols. The actor has also demonstrated persistence mechanisms on infected hosts. Infrastructure used by UAC-0006 has been linked to Russian registrars, Russian hosting, and bulletproof hosting ecosystems including networks associated with Global Connectivity Solutions LLP, Global Internet Solutions LLC, and Railnet LLC / Virtualine. Reporting also notes overlaps in tactics with FIN7, though UAC-0006 is tracked as a distinct CERT-UA cluster.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
36 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only in related content as a financially motivated threat group deploying Smokeloader against PrivatBank in Ukraine; not part of the Bank of Baroda incident itself.
Associated with exploitation of a 7-Zip vulnerability.
Referenced for contrast as a tracked SmokeLoader actor that uses Russian registrars and hosting and targets Ukrainian financial institutions; the report states the ingermany operator is distinct from this actor.
UAC-0006 is conducting phishing campaigns targeting Ukrainian organizations, including PrivatBank, using SmokeLoader malware to steal credentials and sensitive data.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.