Loading threat actor…
UAC-0200 is a Russian-attributed cyber-espionage threat cluster that has targeted Ukraine, particularly Ukrainian government officials, military personnel, defense enterprises, and broader military and defense-sector organizations. The cluster is associated with the delivery and use of the DarkCrystal RAT remote access trojan, also known as DCRat, in socially engineered intrusion campaigns designed to obtain covert access to victim systems and support intelligence collection. A defining tradecraft pattern for UAC-0200 is the use of trusted communication channels and compromised legitimate accounts to increase the credibility of lures. The actor has used the Signal messenger as a malware delivery vector, sending password-protected archives and instructions that pressure victims to open the content on Windows computers rather than mobile devices. These archives have been observed as self-extracting packages that unpack script and executable components which ultimately install DarkCrystal RAT. The group’s operations fit a broader pattern of Russian cyber activity against Ukraine that increasingly emphasizes targeted collection against military and defense-related entities. DarkCrystal RAT usage linked to UAC-0200 provides the actor with persistent remote access and post-compromise control of infected hosts. Reporting tied to DCRat campaigns associated with this cluster indicates capabilities consistent with credential theft, keylogging, persistence, process injection or hollowing, secondary payload delivery, and defense evasion through abuse of legitimate Windows tooling and tampering with security controls. UAC-0200 is one of several Russian-attributed clusters active against Ukraine and is assessed as primarily motivated by espionage.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
26 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously used DCRat in operations targeting Ukraine (as referenced in the content).
Referenced as part of an increase in cyber-espionage activity against Ukraine (no additional details provided in this content).
Russian-attributed threat group targeting Ukraine's defense and military sectors, primarily for intelligence gathering through cyber operations.
UAC-0200 is associated with campaigns exploiting the Signal app to deploy the DCRat trojan.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.