UAC-0184 Malware Targets Ukrainian Military Networks Using Bitsadmin

UAC-0184 has deployed a multi-stage malware chain that utilizes the Windows bitsadmin tool and HTA files to deliver obfuscated payloads. This campaign primarily targets Ukrainian military networks, specifically accounts linked to the Armed Forces of Ukraine. The malware disguises itself using signed binaries like VSLauncher.exe and PassMark Endpoint to maintain stealth. CERT-UA has reported on this activity throughout 2024 and 2025, indicating a focused effort on military-related targets. The attack highlights the ongoing cyber threats faced by Ukraine amid geopolitical tensions. The full scope of the impact remains under investigation as security teams respond to the threat.

Key Points: • UAC-0184 uses bitsadmin and HTA files to deliver malware to Ukrainian military networks. • The campaign targets accounts associated with the Armed Forces of Ukraine. • Malware employs signed binaries for stealth, complicating detection efforts.