UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.
78
Product
Notepad++
- Mentions · 7d0
- Mentions · 30d3
- All mentions5
- First seenSep 2, 2026
- Last mentioned22d ago
Timeline
5 articles · newest firstEarth Sirrush Uses PNG Steganography and Malicious Notepad++ Plugins to Deploy Espionage Malware
Russia-aligned Earth Sirrush hides espionage malware in PNGs and Notepad++ plugins against Ukrainian government and defense targets.
74
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
78
PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks
PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.
55
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
58
Related CVEs
by mentions- CVE-2023-38831100%7.8Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion
Appears with
- CERT-UAorganization · 4
- UAC-0099threat actor · 4
- ASHVEINmalware · 3
- TrendAIorganization · 3
- MATCHBOILmalware · 3
- Earth Sirrushthreat actor · 3
- WinRARproduct · 2
- LUNCHPOKEmalware · 2
- MeowMeowmalware · 2
- Ukrainian governmentvictim · 2
- Sandwormthreat actor · 2
- CINDERBLOTmalware · 2
- ESETorganization · 2
- BURNYBEARmalware · 2
- BadPawmalware · 2
- DRAGSTAREmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.