Loading threat actor…
UAC-0184, also tracked as Hive0156 and in some reporting as UNC5435, is a Russia-aligned cyber-espionage threat actor focused primarily on Ukrainian targets. Its operations have concentrated on representatives of the Ukrainian Defense Forces, military-related personnel, government entities, and legislative bodies including the Verkhovna Rada. The actor’s dominant objective is intelligence collection, particularly theft of documents and messenger data from compromised systems. UAC-0184 is known for socially engineered initial access using messaging platforms and other online communication channels rather than relying solely on email. Reported delivery vectors include Viber, Signal, Telegram, messengers more broadly, and dating or acquaintance-themed outreach. Lures commonly impersonate official Ukrainian documents, criminal or enforcement notices, military administrative paperwork, combat footage, or personal-contact themes tailored to military personnel. A recurring tradecraft pattern is the use of weaponized ZIP archives containing deceptive Windows shortcut files that masquerade as documents, spreadsheets, images, or PDFs. These LNK files typically launch multi-stage downloader chains using native Windows utilities and scripting, including cmd, PowerShell, bitsadmin, mshta, VBScript, and HTA payloads. UAC-0184 has repeatedly used modular loader chains with obfuscation, staged decryption, and in-memory reconstruction to complicate analysis and evade detection. The actor has employed several loader and malware families, including HijackLoader or IDATLoader, SHADOWLADDER, GHOSTPULSE, Remcos RAT, ViottoKeylogger, XWorm, SIGTOP, and TUSC. Observed intrusion chains include DLL side-loading and search-order hijacking through legitimate signed or benign software, including software associated with OneDrive-themed packages, Plane9 components, Bitdefender deployment tooling, Microsoft Visual Studio components, and PassMark BurnInTest or Endpoint components. Payload concealment methods have included XOR decoding, AES decryption, gzip decompression, LZNT1 decompression, pseudo-PNG or IDAT chunk containers, reflective loading of .NET assemblies, and process injection or module stomping. Post-compromise activity includes persistence through scheduled tasks and registry autoruns, remote access, keylogging, theft of files and messenger content, and exfiltration of Signal-related data and contacts. Some observed toolchains also indicate capability for process memory dumping and covert peer or controller communications using repurposed legitimate networking functionality. Delivery infrastructure has shown signs of gating or geofencing to reduce exposure to researchers and sandboxes. The actor’s operational profile is consistent with sustained Russian espionage activity against Ukraine, with campaigns documented across 2024 through 2026. Its hallmark characteristics are Ukraine-focused social engineering, messenger-based lure delivery, LNK-driven execution chains, abuse of legitimate software for sideloading, and deployment of commodity remote-access malware in support of intelligence collection.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
272 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting a Ukraine-themed malware delivery campaign using LNK files, temporary VBScript and PowerShell downloaders, a OneDrive-themed DLL sideload chain, HijackLoader/IDATLoader, and a final Remcos RAT payload.
Targeting Ukrainian military-related entities using LNK lure files to deliver an executable associated with the legitimate PassMark BurnInTest program.
Conducting a targeted malware campaign against Ukraine, particularly military-related targets and individuals connected to the Ukrainian Defence Forces, using social engineering lures, bitsadmin, HTA execution, DLL sideloading, and repurposed legitimate signed software for covert command-and-control.
Conducting espionage-focused intrusions against Ukrainian military-related targets, using messenger and dating-platform social engineering, Ukraine-themed lures, staged malware delivery, HTA/LNK chains, DLL sideloading, and document/messenger data theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.