Кібератаки UAC-0252 з використанням стілерів SHADOWSNIFF та SALATSTEALER (CERT-UA#20032)

Heads up, folks. CERT-UA has issued an advisory (CERT-UA#20032) detailing ongoing cyberattacks attributed to UAC-0252 utilizing SHADOWSNIFF and SALATSTEALER info-stealers. These campaigns have been observed since January 2026, targeting users in Ukraine.

Technical Breakdown

• Threat Actor: UAC-0252
• Malware Families:
  • SHADOWSNIFF (info-stealer)
  • SALATSTEALER (info-stealer)
• Initial Access & Lure: The attacks leverage sophisticated phishing emails designed to impersonate central executive authorities and regional administrations.
  • Social Engineering: Emails urge recipients to "update mobile applications" for widely used civilian and military systems. This tactic aims to trick users into downloading malicious software disguised as legitimate updates.
• Target Scope: Users of critical mobile applications, likely those pertaining to government and defense sectors in Ukraine, given the source and context.
• TTPs:
  • Initial Access (T1566 - Phishing): Distribution of malicious emails.
  • Defense Evasion (T1036 - Masquerading): Impersonation of legitimate government entities.
  • Execution (T1204 - User Execution): Luring users into installing malicious updates.
  • Collection (T1005 - Data from Local System): Use of info-stealers (SHADOWSNIFF, SALATSTEALER) to exfiltrate sensitive data.

Defense

Organizations and individuals should exercise extreme caution with unsolicited requests to update mobile applications, especially those claiming to be from official government or military sources. Always verify update notifications through official channels, app stores, or direct website visits, not by clicking links in emails. Ensure mobile devices have up-to-date security software and are configured to only install apps from trusted sources.

Source: https://cert.gov.ua/article/6287707