Skip to content

UAC-0118

Also reported as FRwL and FromRussiaWithLove.

Reports: 4
Last reported: 6 February 2026

ID: uac-0118
Sources: MISP Malpedia
Merge evidence: 3 alias matches

Reports per quarter

2022 Q4: 1 report
2023 Q1: 2 reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: 1 report

Dated reports, 2022 Q4 to 2026 Q1.

Techniques seen in the last two years

T1083 1 report
T1134 1 report
T1222 1 report
T1222.001 1 report
T1485 1 report
T1529 1 report
T1680 1 report

Counts come from technique IDs in the actor's report text.

Reports

6 February 2026

DynoWiper: From Russia with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor DynoWiper: From Russia with Love
10 March 2023

From Royal with Love

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Royal with Love
10 March 2023

From Royal With Love

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Royal With Love
15 November 2022

Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Somnia Malware Detection: UAC-0118 aka FRwL Launches Cyber Attacks Against Organizations in Ukraine Using Enhanced Malware Strains

Newest first. Details opens the report in Explore.