UAC-0063

UAC-0063, also tracked as TAG-110, is a Russia-aligned cyberespionage intrusion set targeting government bodies, diplomatic missions, educational organizations, and research institutions. Its operations have been documented since at least 2022, with a principal focus on Central Asia and subsequent activity across Europe. Known targets include organizations in Kazakhstan, Tajikistan, Afghanistan, and Ukraine, as well as diplomatic missions in Germany, the United Kingdom, the Netherlands, Romania, and Georgia. The group obtains initial access through spear-phishing, frequently using compromised email accounts and legitimate documents stolen from earlier victims. It weaponizes Microsoft Word documents with VBA macros and uses social engineering to encourage macro execution. Established infection chains deploy HATVIBE, an HTA-based loader and backdoor, followed by espionage implants. Persistence mechanisms include scheduled tasks and malicious global templates that execute when Microsoft Word starts. In early 2025, a Tajikistan-focused campaign used macro-enabled Word templates without embedding the HATVIBE payload used in earlier campaigns. UAC-0063's malware portfolio includes DownEx, also known as STILLARCH; CHERRYSPY, also known as DownExPyer; HATVIBE; LOGPIE; and PyPlunderPlug. These tools support remote command execution, host reconnaissance, targeted file exfiltration, screenshot capture, keylogging, clipboard monitoring, and collection of files from removable media. The group has deployed both Python-based and compiled Cython implant variants and uses encoded or obfuscated payloads and modifications to Office security settings to hinder detection and facilitate execution. Its operations emphasize sustained access and intelligence collection rather than ransomware or extortion.