Loading threat actor…
Scarab is a suspected Chinese cyber-espionage threat actor active since at least 2012. The group is known for highly targeted intrusions against a relatively small number of victims, with a longstanding emphasis on Russian-speaking individuals and organizations, while also conducting operations against targets in Ukraine, the United States, Chile, Syria, and elsewhere. Scarab has also been tracked as UAC-0026 in activity targeting Ukraine. Scarab is associated with custom malware families including Scieron and HeaderTip. Earlier operations used Scieron and Scieron.B, backdoors capable of collecting system information, manipulating files and directories, executing payloads, interacting with the registry, launching remote shells, and downloading additional malware. Scieron.B also incorporated rootkit-like functionality to conceal some network activity. More recent activity linked to UAC-0026 used HeaderTip, a lightweight first-stage backdoor and loader that established persistence and communicated over HTTP POST, likely to support follow-on payload delivery. The actor commonly relies on spearphishing for initial access, using carefully tailored lures aligned to victim interests and current geopolitical events. Observed themes have included academic subjects, finance and G20 matters, Russian news topics, OSCE-related content, the U.S. withdrawal from Afghanistan, and Ukraine war-themed decoys impersonating official Ukrainian entities. Scarab has used malicious document attachments, executable loaders, compressed archives, and older exploit chains including CVE-2012-0158. In some campaigns, victims were required to enable macros; in others, executable loaders unpacked embedded lure documents and malware components while establishing persistence. Tradecraft attributed to Scarab includes use of dynamic DNS for command-and-control, custom malware development, persistence through autorun mechanisms, and selective victimization rather than broad opportunistic compromise. Reporting has linked the group with Chinese-language artifacts and assessed it with moderate to high confidence as a Chinese-speaking espionage actor focused on geopolitical intelligence collection. Scarab has been publicly associated with campaigns against Russian interests following the invasion of Ukraine, including malware operations against Ukrainian organizations and targeted activity against Russian-speaking victims.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
23 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
26 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of multiple Chinese campaigns reflecting intelligence collection objectives against Russia following the invasion of Ukraine.
Associated with malware-themed lures targeting Ukraine during the Russia-Ukraine war.
A suspected Chinese threat actor group that SentinelOne linked to the HeaderTip/UAC-0026 campaign. The content also notes Scarab malware was first observed in 2012 targeting organizations in multiple countries.
Chinese-speaking espionage-oriented threat actor linked to phishing campaigns delivering the HeaderTip backdoor, including targeting Ukraine during the 2022 invasion period as well as prior campaigns against diplomatic and individual targets.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.