Russia-Aligned Cyber Espionage Group UAC-0099 Deploys New ASHVEIN Malware in Sophisticated Campaign Against Ukraine

The evolution of UAC-0099’s tradecraft is a point of concern for the cybersecurity community. Since its inception, the group has transitioned from relatively simple PowerShell- and Go-based tools to more complex, compiled C# binaries. Modern iterations of their malware often utilize .NET Reactor protection to hinder reverse engineering and are frequently concealed within steganographic image files. By hiding malicious code inside the pixels of an image, the group can move its payloads across networks without triggering alerts from security solutions that only scan for known file signatures.

Research from ESET, published in its November 2025 APT Activity Report, provides additional context on the group’s role within the broader Russian intelligence ecosystem. ESET suggests that UAC-0099 may serve as an initial access broker for Sandworm, the notorious Russian APT group linked to the GRU (Main Intelligence Directorate). Sandworm is globally recognized for its destructive cyberattacks, including the infamous NotPetya incident and multiple strikes against Ukraine’s power grid. If UAC-0099 is indeed functioning as a scout or "door opener" for Sandworm, the deployment of ASHVEIN could be a precursor to more damaging operations.

TrendAI’s analysis of the malware’s development environment indicates a highly organized operation. Researchers identified five distinct builds of ASHVEIN compiled between October 8 and October 23, 2025. These builds utilized three different packing variants, suggesting that the group is actively testing different methods to evade detection. The researchers also noted functional overlaps between ASHVEIN and another malware family used by the group, known as DRAGSTARE. Both tools share capabilities in credential theft, screenshotting, and system fingerprinting via Windows Management Instrumentation (WMI).

Despite these similarities, the two malware families appear to be developed in parallel. DRAGSTARE is linked to a developer account known as "NordDragon" and includes specific features such as anti-virtual machine (VM) checks and subnet scanning. ASHVEIN, meanwhile, is compiled under a separate "dev" account and utilizes a different packing strategy. This division of labor suggests that UAC-0099 maintains multiple development streams to meet various operational requirements, ensuring that if one tool is detected, others remain viable.

The delivery methods for ASHVEIN are as varied as its internal functions. The group frequently employs DLL sideloading—a technique where a malicious DLL is placed in a directory with a legitimate executable, which then unwittingly loads the malware. This specific implementation has been dubbed FORGECLAMP. Other delivery vectors include the use of VHD (Virtual Hard Disk) containers and purpose-built .NET droppers.

One particularly effective dropper identified by researchers is named "AnswerFromPolice." This executable is designed to exploit the trust of its victims by displaying a decoy Microsoft Word document that purports to be an official response from the National Police of Ukraine. While the user is distracted by the credible-looking document, the dropper silently installs ASHVEIN in the background. This combination of institutional impersonation and high-quality decoy content is a classic social engineering tactic, tailored to the high-stress environment of a nation at war.