Russia-Aligned Cyber Espionage Group UAC-0099 Deploys New ASHVEIN Malware in Sophisticated Campaign Against Ukraine

The landscape of cyber warfare in Eastern Europe continues to shift as threat actors refine their arsenals to match the evolving technological environment. In a recent disclosure that highlights the persistent nature of Russian-aligned digital operations, cybersecurity researchers have identified a previously undocumented malware strain being utilized by the threat actor known as UAC-0099. This new tool, a .NET-based infostealer and remote access trojan (RAT) internally referred to as "TelemetryBrowser," has been codenamed ASHVEIN.

The discovery, detailed by researchers at TrendAI, sheds light on the group’s long-term evolution and its specific focus on Ukrainian government personnel. TrendAI, which tracks this specific activity cluster under the moniker Earth Sirrush—and was previously identified as SHADOW-EARTH-065—indicates that ASHVEIN represents a significant step forward in the group’s technical capabilities. The malware is not merely a tool for data theft but a comprehensive surveillance platform designed to provide its operators with deep, persistent access to compromised systems.

UAC-0099 is far from a newcomer to the theater of cyber espionage. The group was first officially documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in June 2023, though its activities date back to at least mid-2022. Emerging shortly after Russia’s full-scale invasion of Ukraine, the group has consistently targeted a specific cross-section of the country’s infrastructure, including government offices, defense agencies, border guard services, and logistics entities. This latest campaign suggests that the group’s mission is becoming increasingly specialized, focusing on the very systems that maintain the country’s operational stability.

The technical architecture of ASHVEIN reveals a sophisticated approach to data exfiltration and system control. At its core, the malware is designed to harvest credentials from widely used web browsers, specifically Google Chrome and Mozilla Firefox. However, its utility extends far beyond simple password theft. ASHVEIN is equipped with GDI-based screenshot capture capabilities, allowing it to record the visual activity of a user’s desktop. It also features robust file enumeration and retrieval modules, enabling the attackers to search for and extract specific documents of interest.

One of the more alarming features of ASHVEIN is its ability to execute remote shells via PowerShell, granting the attackers the ability to run arbitrary commands on the infected machine. This effectively turns the malware into a bridgehead for further lateral movement within a targeted network. To maintain communication with its operators, ASHVEIN utilizes encrypted command-and-control (C2) channels. In an effort to remain stealthy, the malware has been observed hiding its tasking instructions inside invisible HTML elements, a technique designed to bypass traditional network monitoring tools that might flag more obvious C2 traffic.

Furthermore, ASHVEIN’s developers have implemented a fallback mechanism to ensure the malware remains functional even if its primary C2 infrastructure is taken down. Some variants utilize a GitHub-based "dead drop resolver," where the malware checks a specific, seemingly benign GitHub repository to find the updated address of its control server. This reliance on legitimate web services to mask malicious traffic is a hallmark of sophisticated APT (Advanced Persistent Threat) groups.