UAC

Gbhackers •Mayura Kathir • May 19, 2026

UAC-0184 uses a multi‑stage malware chain that abuses bitsadmin and HTA loaders to reach a heavily obfuscated payload bundle, ultimately hiding behind signed binaries such as VSLauncher.exe and PassMark Endpoint to gain stealthy network access on Ukrainian military networks. CERT‑UA reporting through 2024–2025 highlights a focus on accounts belonging to the Armed Forces of Ukraine, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

UAC-0184 Malware Targets Ukrainian Military Networks Using Bitsadmin UAC-0184 has deployed a multi-stage malware chain that utilizes the Windows bitsadmin tool and HTA files to deliver obfuscated payloads. This campaign primarily targets Ukrainian military networks, specifically accounts linked to the Armed Forces of Ukraine. The malware disguises itself using signed binaries like VSLauncher.exe and PassMark Endpoint to maintain stealth. CERT-UA has reported on this activity throughout 2024 and 2025, indicating a focused effort on military-related targets. The attack highlights the ongoing cyber threats faced by Ukraine amid geopolitical tensions. The full scope of the impact remains under investigation as security teams respond to the threat. 2 sources 73

Extracted Entities

UAC

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

MITRE ATT&CK (4)

Tools (1)