Loading threat actor…
UAC-0252 is a threat activity cluster tracked by CERT-UA for phishing-led intrusions primarily targeting Ukrainian organizations, especially government and public-sector entities. The actor is associated with campaigns that impersonate Ukrainian national executive authorities and regional administrations, often using lures related to software or mobile-application updates for widely used civilian and military systems. Observed delivery methods include malicious archives containing executables, links to compromised or XSS-vulnerable websites that trigger script-based downloads, and abuse of public code and file-hosting platforms to stage payloads and supporting scripts. Malware linked to UAC-0252 includes SHADOWSNIFF, SALATSTEALER, and the Go-based backdoor DEAFTICK. SALATSTEALER activity associated with this cluster includes theft of browser credentials, cookies, autofill data, and session tokens, as well as exfiltration of collected data over encrypted channels. Related tooling has also shown Windows Defender tampering through PowerShell to weaken endpoint protections. DEAFTICK provides backdoor access, while SHADOWSNIFF and SALATSTEALER support credential and information theft. Reporting also identified actor-controlled repositories containing a WinRAR exploit for CVE-2025-8088 and a ransomware sample internally labeled AVANGARD ULTIMATE v6.0, indicating access to or experimentation with broader offensive tooling. The cluster’s tradecraft emphasizes social engineering, masquerading as trusted Ukrainian institutions, use of legitimate online services for payload hosting, and layered delivery chains intended to reduce detection. Infrastructure and attribution reporting tie the activity to Russian-linked ecosystem elements, and CERT-UA has associated the operation with individuals discussed under the PalachPro identifier. The dominant operational pattern is credential theft and post-compromise access against Ukrainian state targets rather than overt disruptive ransomware deployment.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
MalwareBazaar pivot analysis ties this sample to a broader campaign cluster exploiting CVE-2025-8088 (WinRAR)... Second, CVE-2025-8088 (a WinRAR vulnerability) appears in three related samples from March 3-10. The password-protected RAR in our sample may be designed to exploit this same vulnerability during extraction. Without the password, we cannot confirm this -- but the pattern is suggestive.
A pivot on the UKR tag in MalwareBazaar reveals a coordinated campaign... 2026-03-05 8150b2b3... RAR UKR, CVE-2025-6218, CVE-2025-8088 Military supply unit; 2026-03-03 ba149847... RAR UKR, UAC-0252, CVE-2025-6218, CVE-2025-8088 Unknown.
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A threat activity cluster distributing credential-harvesting malware including Salat Stealer and ShadowSniff, primarily targeting organizations in Ukraine and surrounding regions via phishing emails and trojanized installers to steal browser credentials and session data.
Impersonated Ukrainian government institutions and deployed infostealers via exploitation of a WinRAR vulnerability.
Named campaign cluster targeting Ukraine in early 2026, deploying SalatStealer together with SHADOWSNIFF, DEAFTICK, and AVANGARD ULTIMATE v6.0 ransomware. Initial access reportedly used a WinRAR path traversal exploit delivered via Telegram.
A CERT-UA-tracked threat cluster tentatively linked to this phishing campaign through tactical overlap, including Ukrainian government and military-themed lures, related UKR-tagged samples, and possible exploitation of WinRAR vulnerabilities in archive-based delivery chains.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.