Skip to content
UAC-0050 Targets Ukrainian Agencies with Fraudulent DTEK Emails

UAC-0050 Targets Ukrainian Agencies with Fraudulent DTEK Emails

First seen 30 Oct 2026, 18:46 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 20:46 UTC
  • •UAC-0050 is impersonating DTEK to execute phishing attacks.
  • •Malicious emails contain attachments that install remote access software.
  • •Citizens are advised to verify information through official channels.

On October 29, 2026, cybersecurity experts from CERT-UA reported a new wave of phishing attacks targeting Ukrainian government institutions. The hacker group UAC-0050 is impersonating the company DTEK, sending emails that falsely demand urgent repayment of electricity debts. These emails contain malicious attachments that, when opened, install remote access software called LiteManager on victims' computers. The emails appear to be from a DTEK accountant and include a PDF with a payment link that leads to a password-protected archive. Opening these attachments can compromise user devices, granting hackers remote access. Authorities are urging citizens to verify any such demands through official channels and to avoid opening suspicious files or links. The situation highlights a cybersecurity threat, especially for government entities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-29
Malicious email campaign detected
CERT-UA reported a phishing campaign targeting Ukrainian agencies, using DTEK's name to demand debt repayment.
1news.com.ua
2026-10-29
Cybersecurity warning issued
Ukrainian authorities warned citizens about the dangers of opening attachments from suspicious emails claiming to be from DTEK.
nashemisto.dp.ua

More articles in this cluster (2)

Following this threat?

Track UAC-0050, LiteManager and Yasno in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

What should I do if I receive such an email?
Do not open any attachments or click on links; verify the email through official DTEK channels.
How can I protect my organization from these attacks?
Implement email filtering solutions and conduct regular cybersecurity training for employees.
Are there any known indicators of compromise?
Look for emails from unknown senders demanding urgent payments and containing suspicious attachments.