Loading story…
Ukrainian organizations were targeted in a phishing campaign attributed to UAC-0056—also tracked as SaintBear, UNC2589, and TA471—that used macro-enabled Excel attachments themed around wage arrears to deliver a multi-stage malware chain. Reporting says the infection sequence involved Elephant Dropper, Elephant Downloader, Elephant Implant, and Elephant Client, which retrieved additional payloads from attacker-controlled infrastructure, established persistence, and deployed the GraphSteel and GrimPlant backdoors. Targets reportedly included Ukrainian entities such as ICTV, continuing a pattern of espionage activity against government and state-linked organizations.
The campaign aligns with earlier UAC-0056 operations documented by CERT-UA and other researchers, including phishing emails impersonating Ukrainian government bodies and fake software or update packages such as BitdefenderWindowsUpdatePackage.exe. In those incidents, victims were directed to malicious infrastructure including forkscenter[.]fr, with follow-on payloads fetched from Discord and resulting in Cobalt Strike Beacon, GraphSteel, and GrimPlant infections. Across the observed activity, the malware collected host and network data and sought credentials and user information from browsers, Wi-Fi profiles, Windows Credential Manager and PasswordVault, mail accounts, PuTTY, and FileZilla.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Between March 23 and March 28, 2022, UAC-0056 sent spear-phishing emails with the subject line "wage arrears" to several Ukrainian entities, including ICTV. The emails carried macro-enabled Excel attachments that initiated a multi-stage malware chain.
CERT-UA reported a mass phishing campaign impersonating Ukrainian state authorities and directing targets to forkscenter[.]fr to download a fake Bitdefender update. The infection chain deployed Cobalt Strike Beacon along with the GraphSteel and GrimPlant backdoors, and CERT-UA associated the activity with UAC-0056 with medium confidence.
The actor was also associated with the WhisperGate disruptive attack against Ukrainian government entities in early 2022. The reference cites this as part of the group's prior activity history.
The reporting states that UAC-0056 was previously linked to a wiper attack in January 2022 that affected multiple Ukrainian government computers and websites. This establishes earlier destructive activity associated with the actor.
Malwarebytes reported a new UAC-0056 campaign using malicious Excel documents to deliver Elephant Dropper, Elephant Downloader, Elephant Implant, and Elephant Client. The report detailed how the chain established persistence and deployed the GrimPlant and GraphSteel backdoors to steal system and credential data.
SentinelOne published reporting on UAC-0056 targeting Ukrainians with fake translation software. Later reporting contrasts this lure style with a newer Excel-based phishing campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourceblog.malwarebytes.com
Open sourcesentinelone.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
CERT-UA warned that a phishing campaign targeting Ukrainian organizations used emails impersonating the **National Police of Ukraine** to deliver password-protected `DOCX` attachments disguised as criminal investigation reports. The documents were macro-free but contained embedded `OLE` objects that, when opened by a user, created and executed a JavaScript file, which then used **PowerShell** to retrieve an executable payload from **Discord CDN** and infect the victim with **OutSteel** malware. CERT-UA linked the activity to the **UAC-0056** threat group and published file, host, process, and network indicators of compromise. Technical analysis of one lure showed the dropped script writing a file to the Temp directory, launching it with `wscript.exe`, downloading `putty.exe` from Discord, renaming it to `GoogleChromeUpdate.exe`, and executing it. A related sample reviewed alongside the campaign used an auto-running Excel VBA macro that invoked `certutil.exe` to fetch a batch payload, illustrating the broader use of weaponized Office documents against Ukrainian entities during the Russia-Ukraine conflict. CERT-UA advised defenders to block unnecessary Internet services such as Discord and prevent Microsoft Office applications from spawning risky child processes including `wscript.exe` and `powershell.exe`.
Aug 15, 2026