UAC-0219 is a cyberespionage threat actor identified by Ukraine's Computer Emergency Response Team (CERT-UA) that emerged in the fall of 2024 with campaigns employing early WRECKSTEEL variants. The group's primary motivation is state-sponsored espionage, specifically the theft of sensitive data from Ukrainian state institutions and critical infrastructure. It focuses on intelligence gathering within the context of the Russia-Ukraine conflict. UAC-0219 distinguishes itself through its consistent targeting of Ukrainian government agencies, critical infrastructure, military innovation hubs, armed forces, law enforcement, and regional government bodies. While Russian-linked based on targeting and thematic alignment, CERT-UA has not made a direct public attribution to a specific nation-state entity. The group’s operations saw continued evolution into 2025, with enhanced PowerShell capabilities observed in March 2025.

Actores similares

uac-0008actor · 1UAC-0194apt · 0UAC-0185apt · 0UAC-0020apt · 0UAC-0149apt · 0UAC-0215apt · 0UAC-0006apt · 0UAC-0226apt · 0Guacamayaapt · 0UAC-0063apt · 0