UAC-0099 Targets Ukrainian Government with ASHVEIN Malware

• •UAC-0099 is targeting Ukrainian government personnel with the ASHVEIN malware.
• •ASHVEIN combines credential theft, surveillance, and remote access capabilities.
• •The threat actor has evolved its malware arsenal since mid-2022, utilizing various delivery methods.

The Russia-aligned threat actor UAC-0099 has been linked to a new .NET infostealer and RAT named ASHVEIN, targeting Ukrainian government personnel. This malware, also referred to as 'TelemetryBrowser,' features capabilities such as credential theft from Chrome and Firefox, screenshot capture, and remote shell execution. ASHVEIN is part of a broader malware arsenal developed by UAC-0099, which has been active since at least mid-2022, following Russia's full-scale invasion of Ukraine. The group has utilized various delivery methods, including DLL sideloading and VHD containers, and has been involved in spear-phishing campaigns against government and defense entities. TrendAI reports that ASHVEIN overlaps functionally with previous malware like DRAGSTARE but has distinct differences. The threat actor has evolved its tools over the years, transitioning from PowerShell and Go-based malware to .NET-based binaries. The ongoing cyber espionage efforts by UAC-0099 highlight the persistent threat to Ukrainian infrastructure amidst geopolitical tensions.