UAC-0226 is actively deploying a refined version of the GIFTEDCROOK stealer through weaponized WinRAR archives. Using a Ukrainian military-themed decoy targeting reconnaissance and UAV personnel, the attackers drop a sophisticated infection chain onto victim machines.
Unlike previous iterations that required manual user interaction with extracted files, this campaign exploits NTFS Alternate Data Streams and path traversal vulnerabilities to achieve silent persistence.
The malware effectively hides its presence while targeting highly sensitive data across the compromised system. The attack begins with a maliciously crafted PDF file containing references to fiber-optic drones and military ranks.
When the victim extracts the archive, the payload exploits recent path traversal vulnerabilities, specifically CVE-2025-8088 and CVE-2025-6218.
It silently drops an execution shortcut directly into the Windows Startup directory.
It places two hidden stage files in the local application data folder once the user logs in, the shortcut triggers a minimized command prompt that launches a hidden PowerShell process to begin the main infection chain.
DWORD 0: thread exit code
DWORD 1: value at decoded image + 0x44
DWORD 2: value at decoded image + 0x48
DWORD 3: value at decoded image + 0x4CGIFTEDCROOK Steals Sensitive Data
The attackers significantly upgraded their evasion techniques to bypass modern endpoint detection systems.
The initial PowerShell script is buried under thousands of lines of generated garbage code, unused helper functions, and random variable names, all of which complicate static analysis.
The script dynamically resolves critical native APIs, such as NtAllocateVirtualMemory and NtCreateThreadEx, via .NET reflection to avoid obvious process-injection signatures.
Once running, it reads the staged payload and applies a mathematical decoding operation to reveal the stealer.
Instead of injecting a standard executable, the PowerShell loader reconstructs a headerless Portable Executable image in memory.
The payload features a custom reflective mapper exported as Main.dll!A function that manually builds the dynamic-link library.
hxxps://142.111.194[.]73:8640/dj5FZEiLnA/Synapticsystems said, once fully unpacked in memory, the GIFTEDCROOK stealer aggressively hunts for high-value credentials and proprietary documents.
It avoids suspicious API calls by walking the process environment block directly to locate necessary system variables, such as temporary folders and user profiles.
The internal strings remain heavily protected by an RC4-like stream cipher that processes 16-bit values corresponding to UTF-16 words rather than standard 8-bit characters.
The payload features dedicated collection modules tailored for specific web browsers and sensitive file formats.
It decrypts local secrets by targeting the data protection interfaces used by Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera.
The malware also parses Firefox profile directories to extract stored logins, key databases, and active session cookies.
Indicators of Compromise (IoCs)
| Indicator Type | Value | Description |
|---|---|---|
| SHA-256 | 420f1931af9b3f7d02c5edfc78eb69abdad6e71d2c3e9b81f9cbc3823a503654 | Malicious WinRAR Archive |
| SHA-256 | dc4c906e56ecb446cbb10b227e1fb470e428108584678314533d80e52a2b9b30 | Decoy PDF (Military theme) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
