Earth Sirrush (Threat actor): news timeline & CVEs

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.

TrendAI attributes a new .NET infostealer and RAT, ASHVEIN (internally TelemetryBrowser), to Russia-aligned UAC-0099, also tracked as Earth Sirrush, in attacks on Ukrainian government personnel. ASHVEIN steals Chrome and Firefox credentials, captures screenshots, collects files, runs PowerShell, and hides tasking in invisible HTML, with a GitHub dead-drop fallback. Delivery includes DLL sideloading, VHD containers, and a National Police of Ukraine decoy. ESET also reported a VBScript that embeds a prohibited-weapons prompt to trip LLM safety filters and hinder analysis of the MATCHBOIL loader.

The Hacker NewsOct 8, 15:26 UTC · 9h agoThreat actor in the wild 3 sources

Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware

Russia-aligned Earth Sirrush hides espionage malware in PNGs and Notepad++ plugins against Ukrainian government and defense targets.

Earth Sirrush, overlapping CERT-UA's UAC-0099 and previously tracked as SHADOW-EARTH-065, has targeted Ukrainian government, defense, border, and logistics organizations since at least 2022. TrendAI traced more than 10 malware families through July 2026, including PNG steganography campaigns CINDERBLOT/BadPaw, the LUNCHPOKE Notepad++ plugin, loaders BURNYBEAR and MATCHBOIL.V2, and the ASHVEIN stealer and RAT. Earlier activity exploited WinRAR CVE-2023-38831; newer chains use phishing, scheduled tasks, and DLL proxying. ASHVEIN steals Chrome and Firefox credentials, captures screenshots, and runs remote PowerShell.

Cyber Security Newsupdated Oct 8, 15:26 UTC · 9h agofirst Oct 7, 12:39 UTC · 1d agoThreat actor in the wild 3 sources CVE-2023-38831

Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine

Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.

TrendAI says Russia-aligned Earth Sirrush, also tracked as SHADOW-EARTH-065 and CERT-UA's UAC-0099, has spear-phished Ukrainian government, defense, border, and logistics targets since at least 2022 through July 2026. Early intrusions used archives, HTA files, and WinRAR flaw CVE-2023-38831; later chains added C# tools such as MATCHBOIL and the ASHVEIN stealer-RAT, image steganography in CINDERBLOT, and the LUNCHPOKE Notepad++ plugin. Shared signatures, XOR routines, and Regery-plus-Cloudflare infrastructure tie the clusters together. ESET's view that UAC-0099 may have given Sandworm initial access is presented as a hypothesis, not confirmed control.

GBHackersupdated Oct 8, 15:26 UTC · 9h agofirst Oct 7, 08:01 UTC · 1d agoThreat actor in the wild 3 sources CVE-2023-38831

Earth Sirrush

Timeline3 articles

Related CVEsby mentions

Appears with

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

Earth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware

Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine