UAC-0226

Reports per quarter

Techniques seen in the last two years

• T1005 1 report
• T1016 1 report
• T1027 1 report
• T1027.007 1 report
• T1041 1 report
• T1055 1 report
• T1059.001 1 report
• T1070.004 1 report
• T1071.001 1 report
• T1082 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2023-43770 KEV
• CVE-2024-27443 KEV
• CVE-2024-37383 KEV
• CVE-2025-27915 KEV
• CVE-2025-49113 KEV
• CVE-2025-8088 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 22 July 2026

   Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Beyond the Archive: CVE-2025-8088 Stealer Targeting Ukraine

2. 10 October 2025

   Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Ukraine sees surge in AI-Powered cyberattacks by Russia-linked Threat Actors

3. 26 June 2025

   GIFTEDCROOK’s Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor GIFTEDCROOK’s Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations

4. 7 April 2025

   UAC-0226 Attack Detection: New Cyber-Espionage Campaign Targeting Ukrainian Innovation Hubs and Government Entities with GIFTEDCROOK Stealer

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor UAC-0226 Attack Detection: New Cyber-Espionage Campaign Targeting Ukrainian Innovation Hubs and Government Entities with GIFTEDCROOK Stealer

5. 6 April 2025

   CERT-UA

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor CERT-UA

Newest first. Details opens the report in Explore.