DEAFTICK
DEAFTICK is a primitive Go-based backdoor observed by CERT-UA in phishing campaigns tracked as UAC-0252 targeting Ukraine. Since January 2026, the campaign has impersonated Ukrainian central executive authorities and regional administrations, urging recipients to update widely used civilian and military mobile applications. Delivery has occurred either through attached archives containing malicious EXE files or through links to legitimate but XSS-vulnerable websites that execute JavaScript and download an executable. The operators also abused GitHub to host payloads and scripts.
CERT-UA confirmed DEAFTICK use during January-February 2026 alongside SHADOWSNIFF and SALATSTEALER. Mentioned DEAFTICK samples include Diia_Update_4.7.1_Official.exe, EdgeUpdate.exe, and build.exe. Reported file indicators for DEAFTICK are: Diia_Update_4.7.1_Official.exe MD5 e457cb42ca5a6ecd8b99d89ed2958b29, SHA-256 b5e685e57c625032ec067be94a2854cce1b7c5a51e8d6bd833841a893d5d88b7; EdgeUpdate.exe MD5 f3dc1e16cde2995f701c8db509f351c9, SHA-256 e5941df780ae251bcafad3b833f45ee44bd1599ab45b7adf1f1c79510930642d; build.exe MD5 dcc2c9a08044e8b3e445f17461d054f1, SHA-256 7b35b332a999d56d65241a4f35bbce2e9ad2644a84c09f7dbae42e39cd559bcf.
Associated network indicators in the broader activity include hXXp://150[.]241.64.21:8888/client/addclient, hXXp://95[.]85.224.14:8000/client/addclient, and hXXps://nfkavn[.]bond/client/addclient. Host-based indicators reported with the campaign include commands to hide %TMP%\svchost.exe, add a Microsoft Defender exclusion for that file, and create a Run key persistence value named WindowsUpdateService pointing to %TMP%\svchost.exe. CERT-UA associates the activity with individuals discussed on the Telegram channel "PalachPro."
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
UAC-0252 Campaign (Jan--Feb 2026) SalatStealer was deployed alongside three other tools in a campaign targeting Ukraine, tracked as UAC-0252 ... Initial vector: CVE-2025-8088 (WinRAR path traversal) distributed via the PalachPro Telegram channel. | SalatStealer was deployed alongside three other tools in a campaign targeting Ukraine, tracked as UAC-0252: DEAFTICK -- surveillance module
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group's arsenal includes an infostealer named SHADOWSNIFF, a Malware-as-a-Service (MaaS) variant called SALATSTEALER, and DEAFTICK, a Go-based backdoor strain.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
4 techniques
Initial Access
They either deliver a compressed archive containing a malicious executable file directly, or they provide a link to a compromised website.
CERT-UA identified a malicious campaign (dubbed UAC-0252) impersonating national executive authorities and regional government officials to deceive the victims.
Execution
3 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Command and Control
2 techniques
Command and Control
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A surveillance module used alongside SalatStealer in the UAC-0252 campaign targeting Ukraine.
A Go-based backdoor strain used by UAC-0252 to provide unauthorized access on compromised systems.
A primitive Go-based backdoor referenced as used in the CERT-UA-described activity.
Примітивний бекдор, написаний на Go, який маскується під легітимні оновлення (наприклад, EdgeUpdate.exe / Diia_Update_4.7.1_Official.exe) та встановлює персистентність через ключ Run у HKCU.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.