Full Report
Russian state-sponsored threat actors have been observed leveraging the infamous ClickFix strategy to trick Ukrainian targets into infecting their own machines with data-stealing malware. According to the Computer Emergency Response Team of Ukraine (CERT-UA), the activity has been attributed to UAC-0145, a sub-cluster within Sandworm, an advanced hacking unit affiliated with GRU, Russia's
Analysis Summary
# Threat Actor: UAC-0145
## Attribution & Identity
- **Name:** UAC-0145
- **Known Association:** Identified as a sub-cluster within **Sandworm** (also known as Voodoo Bear, FrozenVista).
- **Affiliation:** Affiliated with the **GRU** (Main Intelligence Directorate), Russia's primary foreign military intelligence agency.
## Activity Summary
In a campaign observed between June and July 2026, UAC-0145 targeted Ukrainian users by compromising at least 10 websites to deploy the "ClickFix" social engineering strategy. The actor also utilized malicious Android APKs distributed via messaging apps to backdoor mobile devices. This activity represents a shift from their previous tactics of using trojanized Microsoft Office installers or fake antivirus software shared via Signal.
## Tactics, Techniques & Procedures
- **Social Engineering (ClickFix):** Tricking users into executing malicious PowerShell commands by presenting fake CAPTCHA or error screens.
- **EtherHiding:** Leveraging Ethereum smart contracts to host and retrieve malicious domain names for command-and-control.
- **Cloaking:** Utilizing "Cloaking[.]House" to filter web traffic and serve malicious content only to specific victims while hiding from security scanners.
- **Dynamic Content Injection:** Using a bespoke tool called "SMARTAXE" to alter web pages based on visitor profiles.
- **Malware Execution:** Directing users to run PowerShell commands that download VBS files into the Startup directory for persistence.
- **Living off the Land:** Using legitimate APIs (Dropbox, Steam Community) for C2 communication and data exfiltration.
- **Mobile Backdooring:** Distributing malicious APK files disguised as security utilities via messaging apps.
## Targeting
- **Sectors:** Government, Military, and General Ukrainian citizens.
- **Geography:** Ukraine.
- **Victims:** Visitors to compromised Ukrainian websites and users of messaging applications.
## Tools & Infrastructure
- **Malware - Windows:**
- **GHETTOVIBE:** VBS-based malware placed in the Startup directory.
- **SCOUTCURL:** PowerShell script used for initial system reconnaissance.
- **FLUIDLEECH / LOADLOOP:** Loaders used for secondary payload delivery; FLUIDLEECH often masquerades as antivirus software.
- **FREAKYPOLL:** A Python-based backdoor.
- **Malware - Android:**
- **COWARDDUCK:** A full-featured backdoor capable of stealing contacts, geolocation, and specific file types (.conf, .ovpn, .doc, .zip, etc.).
- **Infrastructure:**
- **SMARTAXE:** Custom web injection tool.
- **Cloaking[.]House:** Traffic filtering service.
- **Ethereum Smart Contracts:** Used for infrastructure resilience.
- **Abused Services:** dropbox[.]com, steamcommunity[.]com.
## Implications
The adoption of the "ClickFix" strategy by a GRU-affiliated actor like UAC-0145 demonstrates a trend of state-sponsored groups adopting highly effective TTPs from the e-crime ecosystem (the "commercialization" of state-sponsored attacks). By using EtherHiding and legitimate cloud APIs, the actor increases the difficulty of detection and infrastructure takedown, posing a persistent threat to Ukrainian data integrity and national security.
## Mitigations
- **User Training:** Educate employees on the "ClickFix" technique; emphasize that legitimate CAPTCHAs or websites will never ask a user to copy-paste and run PowerShell commands.
- **Endpoint Protection:** Restrict PowerShell execution via execution policies or AppLocker to prevent unauthorized scripts from running.
- **Network Monitoring:** Monitor for unusual outbound traffic to legitimate services like Dropbox or Steam from unauthorized system processes.
- **Mobile Security:** Implement Mobile Device Management (MDM) to block the installation of APKs from "Unknown Sources" and messaging apps.
- **Web Filtering:** Block access to known traffic-cloaking services and monitor for connections to Ethereum gateway domains used in EtherHiding.