UAC-0099 Deploys ASHVEIN RAT Targeting Ukrainian Government Staff
The Russia-aligned threat actor UAC-0099 is deploying the ASHVEIN RAT, a .NET infostealer, against Ukrainian government personnel using obfuscated commands in HTML, indicating an evolving espionage effort.
Why it matters
This campaign highlights the continued use of sophisticated techniques by a state-aligned threat actor to target critical government infrastructure during an ongoing geopolitical conflict.
SOC impact
Investigate and monitor for ASHVEIN RAT indicators, especially HTML-based hidden commands. Assess telemetry for suspicious .NET activity and connections linked to UAC-0099’s Earth Sirrush cluster to improve detection and response.
Recommended actions
- Analyze network traffic for unusual HTML command patterns
- Monitor endpoint processes for .NET infostealer activity
- Identify and review access to government-related assets
- Correlate event logs with known UAC-0099 behaviors from threat intelligence
- Track remote connections associated with Earth Sirrush cluster indicators
Executive Summary
The Russia-aligned threat actor UAC-0099 is currently leveraging a new .NET-based remote access trojan (RAT) and infostealer named ASHVEIN in targeted attacks against Ukrainian government staff. This malware utilizes a novel method of hiding operational commands within HTML content, complicating detection efforts. TrendAI tracks this activity under the cluster Earth Sirrush, reaffirming the ongoing evolution of state-sponsored cyber espionage tactics aimed at government entities within a high-conflict region. Understanding these operational details is critical for defenders to identify, monitor, and respond effectively to this targeted threat activity.
SOC Impact
Investigate and monitor for ASHVEIN RAT indicators, especially HTML-based hidden commands. Assess telemetry for suspicious .NET activity and connections linked to UAC-0099’s Earth Sirrush cluster to improve detection and response.
Detection and Telemetry Review
- Analyze network traffic for unusual HTML command patterns
- Monitor endpoint processes for .NET infostealer activity
- Identify and review access to government-related assets
- Correlate event logs with known UAC-0099 behaviors from threat intelligence
- Track remote connections associated with Earth Sirrush cluster indicators
Why It Matters
This campaign highlights the continued use of sophisticated techniques by a state-aligned threat actor to target critical government infrastructure during an ongoing geopolitical conflict.