Loading threat actor…
UAC-00411 is a threat cluster associated with phishing-led delivery of Snake Keylogger, a .NET information-stealing malware family of Russian origin that is also distributed through a malware-as-a-service model. The cluster has been linked to campaigns against Ukraine and has used topical social-engineering lures tied to oil products and broader geopolitical tensions affecting energy markets. Observed tradecraft includes spearphishing with archive attachments, abuse of a legitimate Java utility for DLL sideloading, execution of a malicious loader chain, process injection into a legitimate Windows utility, and persistence through autorun mechanisms. The malware supports credential theft from multiple web browsers, email clients, and file-transfer applications, gathers host and geolocation information, and exfiltrates stolen data over SMTP. Based on the observed operations, UAC-00411 demonstrates capabilities in initial access, defense evasion, persistence, process injection, credential theft, and data exfiltration. The alias TA558.2 has been associated with this activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.