The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a severe surge in cyberattacks orchestrated by the UAC-0247 threat group targeting municipal governments and healthcare institutions throughout March and April 2026.
This sophisticated campaign focuses heavily on clinical and emergency hospitals, deploying custom malware to harvest sensitive data from web browsers and WhatsApp accounts.
Complex Attack Chains and Custom Malware
The attack typically begins with a deceptive phishing email that appears to discuss humanitarian aid proposals. These messages entice victims to click on malicious links that redirect to legitimate websites compromised by cross-site scripting (XSS) vulnerabilities.
To make the deception more convincing, attackers also deploy entirely fake organizational web pages generated using artificial intelligence tools.
Once a victim clicks the link, their system downloads a compressed archive containing a malicious shortcut (LNK) file.
Opening this shortcut triggers a chain reaction that runs an HTA file, displays a decoy form, and silently downloads an executable payload via a scheduled task to inject shellcode into legitimate processes such as RuntimeBroker.exe.
Widespread Data Theft and Mitigation
Once entrenched in the network, the UAC-0247 group focuses aggressively on data exfiltration and lateral movement.
The attackers use specialized tools to steal sensitive communications, including a utility named CHROMELEVATOR that extracts authentication credentials by bypassing protections in Chromium-based browsers.
Additionally, they use ZAPIXDESK, a forensic extraction tool designed to decrypt local WhatsApp Web databases.
The threat actors conduct extensive network reconnaissance using subnet scanners such as RUSTSCAN and establish hidden network tunnels using utilities such as LIGOLO-NG and CHISEL.
In some isolated cases, the attackers even deployed an XMRIG cryptocurrency miner hidden within a modified version of the legitimate WIREGUARD application.
Beyond civilian infrastructure, the campaign has actively targeted the Ukrainian Defense Forces.
In March 2026, attackers used the Signal messaging app to distribute a fake update for drone operator software called “BACHU”. This malicious archive secretly installed the AGINGFLY backdoor via DLL side-loading.
According to CERT-UA, organizations must take proactive defensive measures to protect their networks from this aggressive threat. Security teams can significantly reduce their attack surface by implementing the following mitigation strategies:
- Restrict execution of potentially dangerous file types, including LNK, HTA, and JS.
- Limit or block the use of legitimate system utilities that attackers frequently abuse, such as mshta.exe, powershell.exe, and wscript.exe.
- Monitor network traffic for anomalous connections to unknown Telegram channels or unrecognized IP addresses.
- Implement strict endpoint monitoring to detect unauthorized DLL side-loading and credential dumping attempts.
By relying on standard operating system protection mechanisms, organizations can disrupt the initial infection vectors and prevent attackers from establishing a foothold.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 has identified a severe surge in cyberattacks orchestrated by the UAC-0247.){kind=link}