UAC-0099 Deploys ASHVEIN RAT Against Ukrainian Officials

Introduction

Recent reporting from TrendAI highlights a notable escalation in cyber operations directed at Ukrainian state institutions. The threat cluster, tracked as UAC-0099 and also known under the alias Earth Sirrush (formerly SHADOW-EARTH-065), has introduced a new .NET-based malware family dubbed ASHVEIN. This remote access trojan (RAT) combines infostealing capabilities with covert command-and-control (C2) channels that hide instructions inside seemingly benign HTML files. The following analysis unpacks the technical details of ASHVEIN, outlines the observed attack flow, and offers strategic recommendations for defenders.

Understanding the UAC-0099 Threat Landscape

UAC-0099 has been linked to Russian-aligned cyber espionage activities for several years, focusing primarily on governmental and military targets in Eastern Europe. The group’s rebranding to Earth Sirrush reflects an evolution in its tooling and operational security. Unlike earlier campaigns that relied heavily on phishing macros or compromised software updates, the latest activity shows a shift toward custom .NET binaries that are harder to detect with traditional signature‑based defenses.

• Attribution: Multiple independent researchers have correlated infrastructure (C2 domains, code signing certificates) with previously observed UAC-0099 activity.
• Motivation: Intelligence gathering, likely to support geopolitical objectives related to the ongoing conflict in Ukraine.
• Operational pattern: The group conducts prolonged reconnaissance before deploying payloads, aiming for persistent access rather than quick financial gain.

Technical Dissection of ASHVEIN RAT

ASHVEIN is a .NET 4.8 executable that packs several malicious modules into a single binary. Its core functionalities include:

• Information stealing: Harvests credentials from web browsers, email clients, and VPN configurations; captures screenshots; and logs keystrokes.
• Remote access: Provides attackers with a reverse shell capable of executing arbitrary commands, uploading/downloading files, and spawning additional processes.
• Stealthy C2: Instead of using plain HTTP or DNS, ASHVEIN embeds command strings inside HTML comments or data‑attributes of innocuous‑looking web pages hosted on compromised legitimate sites. The malware periodically fetches these pages, extracts the hidden instructions via a simple regex, and acts accordingly.
• Persistence mechanisms: Creates scheduled tasks, modifies registry Run keys, and drops copies of itself in user‑profile folders under benign‑sounding names.

The use of HTML as a covert channel is particularly noteworthy because it blends with normal web traffic, making network‑based anomaly detection less effective unless deep packet inspection or SSL‑breaking is in place.

Attack Vectors and Infection Chain

Based on telemetry from compromised Ukrainian government workstations, the infection chain follows these stages:

1. Initial access: Spear‑phishing emails containing a weaponized Office document that, when macros are enabled, drops a loader script.
2. Loader execution: The script downloads the ASHVEIN payload from a compromised third‑party domain, often masquerading as a legitimate software update.
3. Execution and evasion: ASHVEIN checks for sandbox artifacts, then injects itself into a legitimate process (e.g., explorer.exe) to evade process‑based monitoring.
4. C2 communication: The malware initiates an HTTPS GET request to a benign‑looking news site; the server’s response includes HTML with embedded Base64‑encoded commands inside <!-- CMD: ... --> comments.
5. Post‑exploitation: Attackers exfiltrate harvested data via the same covert channel, often chunking large files across multiple HTML responses to avoid size‑based triggers.

Implications for Ukrainian Government Security

The targeting of civil servants and diplomatic staff indicates a strategic aim to gather policy discussions, negotiation positions, and internal communications. Successful compromise could enable adversaries to anticipate governmental moves, influence diplomatic outcomes, or facilitate further attacks on critical infrastructure.

Defenders should prioritize:

• Enhanced email security with attachment sandboxing and macro‑blocking policies.
• Web‑proxy controls that inspect HTML content for anomalous hidden data (e.g., unusually long comments or data‑attributes).
• Endpoint detection and response (EDR) solutions capable of detecting .NET process injection and unauthorized scheduled‑task creation.
• Regular credential rotation and multi‑factor authentication for privileged accounts, especially those accessing email and VPN services.
• Threat‑intelligence feeds that track domains and certificates associated with Earth Sirrush/UAC-0099 for proactive blocking.

Conclusion

The UAC-0099 campaign employing ASHVEIN RAT illustrates how geopolitical tensions continue to drive sophisticated, stealthy cyber operations against Ukrainian governmental entities. While the malware’s use of HTML‑based command hiding is novel, the underlying tactics—spear‑phishing, process injection, and persistent footholds—remain consistent with established espionage playbooks. By strengthening email defenses, monitoring web traffic for covert channels, and maintaining robust endpoint visibility, organizations can markedly reduce the risk of compromise. Grivyonx Cloud’s AI‑driven automation and cybersecurity services are designed to detect such subtle anomalies early, helping defenders stay ahead of evolving threats like ASHVEIN.