UAC

Cybersecuritynews •Tushar Subhra Dutta • May 19, 2026

A newly documented attack chain linked to the threat group UAC-0184 has been observed using Windows’ built-in bitsadmin tool and HTA files to sneak malicious payloads onto targeted systems. The campaign is primarily aimed at Ukraine, with clear indicators pointing toward military-related targets, including individuals connected to the Ukrainian Defence Forces. The level of craft […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAC-0184 Malware Targets Ukrainian Military Networks Using Bitsadmin UAC-0184 has deployed a multi-stage malware chain that utilizes the Windows bitsadmin tool and HTA files to deliver obfuscated payloads. This campaign primarily targets Ukrainian military networks, specifically accounts linked to the Armed Forces of Ukraine. The malware disguises itself using signed binaries like VSLauncher.exe and PassMark Endpoint to maintain stealth. CERT-UA has reported on this activity throughout 2024 and 2025, indicating a focused effort on military-related targets. The attack highlights the ongoing cyber threats faced by Ukraine amid geopolitical tensions. The full scope of the impact remains under investigation as security teams respond to the threat. 2 sources 73

Extracted Entities

UAC

The full story

Extracted Entities

Attack Types (1)

Countries (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (1)