UAC-0226 is a cyber espionage threat actor active since February 2025, assessed with high confidence to be of Russian origin. The group primarily targets Ukrainian military formations, law enforcement agencies, local government bodies, and defense innovation hubs near the eastern border. Their main objective is targeted intelligence collection, notably through the deployment of information-stealing malware via phishing emails. A distinguishing characteristic of UAC-0226 is their use of macro-enabled Excel documents for initial compromise and the GIFTEDCROOK stealer for browser data exfiltration to Telegram. The group has also been tracked under the alias SHADOW-EARTH-066.

Actores similares

uac-0008actor · 1UAC-0194apt · 0UAC-0185apt · 0UAC-0020apt · 0UAC-0219apt · 0UAC-0149apt · 0UAC-0215apt · 0UAC-0006apt · 0Guacamayaapt · 0UAC-0063apt · 0