UAC-0194
UAC-0194 is a threat actor cluster assessed in the provided reporting as likely linked to Russia or suspected of having Russian affiliations. The group is associated with cyber operations targeting Ukrainian entities. Reporting links UAC-0194 to in-the-wild weaponization of CVE-2024-43451, a Windows flaw involving malicious Internet Shortcut/.url files that can trigger outbound SMB authentication and expose NTLM/NTLMv2 hashes with minimal user interaction. The activity described includes phishing campaigns themed around renewal of academic certificates, including ZIP archives containing a benign-looking diploma PDF and a malicious URL file, and use of files hosted on an official Ukrainian government site related to academic certificates. CERT-UA technical information cited in the content indicates the exploit was part of a broader campaign aimed at Ukrainian entities. ClearSky assessed the activity as likely linked to UAC-0194 and reported infrastructure tied to a Russian VPS provider. The same exploitation chain was reported as being used to distribute SparkRAT and later Redline Stealer. Additional reporting in the content states that CVE-2024-43451 first emerged in a cyberattack operation launched by UAC-0194 against Ukraine, and that later variant exploitation of related NTLM hash disclosure issues referenced UAC-0194 as a prior actor linked to this tradecraft. No aliases beyond the identical form "uac_0194" are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
ClearSky Cyber Security has uncovered a new zero-day vulnerability, CVE-2024-43451, actively exploited in the wild, targeting Windows systems primarily in Ukraine. This flaw enables attackers to exploit URL files for malicious activity by performing actions as simple as a single right-click.
A recently patched security flaw affecting Windows NTLM has been exploited by malicious actors to leak NTLM hashes or user passwords and infiltrate systems since March 19, 2025. The flaw, CVE-2025-24054 (CVSS score: 6.5), is a hash disclosure spoofing bug that was fixed by Microsoft last month as part of its Patch Tuesday updates. The security flaw is assessed to be a variant of CVE-2024-43451 (CVSS score: 6.5), which was patched by Microsoft in November 2024 and has also been weaponized in the wild in attacks targeting Ukraine and Colombia by threat actors like UAC-0194 and Blind Eagle.
Observables
2 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with early use of CVE-2024-43451 in operations against Ukraine (as referenced for provenance of the vulnerability’s observed exploitation).
UAC-0194 is known for exploiting Windows NTLM vulnerabilities, specifically CVE-2025-24054 and its variant CVE-2024-43451, to leak NTLM hashes or user passwords and infiltrate systems. They have targeted Ukraine and Colombia.
Referenced as a threat actor that has weaponized CVE-2024-43451 in real-world attacks, targeting Ukraine and Colombia.
Mentioned as a Russian APT group previously linked to exploitation of CVE-2024-43451 via a .url file; in this reporting, that technique/file is reused alongside CVE-2025-24054 exploitation artifacts.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.