Russia-Aligned Cyber Espionage Group UAC-0099 Deploys New ASHVEIN Malware in Sophisticated Campaign Against Ukraine

The landscape of cyber warfare in Eastern Europe continues to shift as threat actors refine their arsenals to match the evolving technological environment. In a recent disclosure that highlights the persistent nature of Russian-aligned digital operations, cybersecurity researchers have identified a previously undocumented malware strain being utilized by the threat actor known as UAC-0099. This new tool, a .NET-based infostealer and remote access trojan (RAT) internally referred to as "TelemetryBrowser," has been codenamed ASHVEIN.

The discovery, detailed by researchers at TrendAI, sheds light on the group’s long-term evolution and its specific focus on Ukrainian government personnel. TrendAI, which tracks this specific activity cluster under the moniker Earth Sirrush—and was previously identified as SHADOW-EARTH-065—indicates that ASHVEIN represents a significant step forward in the group’s technical capabilities. The malware is not merely a tool for data theft but a comprehensive surveillance platform designed to provide its operators with deep, persistent access to compromised systems.

UAC-0099 is far from a newcomer to the theater of cyber espionage. The group was first officially documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in June 2023, though its activities date back to at least mid-2022. Emerging shortly after Russia’s full-scale invasion of Ukraine, the group has consistently targeted a specific cross-section of the country’s infrastructure, including government offices, defense agencies, border guard services, and logistics entities. This latest campaign suggests that the group’s mission is becoming increasingly specialized, focusing on the very systems that maintain the country’s operational stability.

The technical architecture of ASHVEIN reveals a sophisticated approach to data exfiltration and system control. At its core, the malware is designed to harvest credentials from widely used web browsers, specifically Google Chrome and Mozilla Firefox. However, its utility extends far beyond simple password theft. ASHVEIN is equipped with GDI-based screenshot capture capabilities, allowing it to record the visual activity of a user’s desktop. It also features robust file enumeration and retrieval modules, enabling the attackers to search for and extract specific documents of interest.

One of the more alarming features of ASHVEIN is its ability to execute remote shells via PowerShell, granting the attackers the ability to run arbitrary commands on the infected machine. This effectively turns the malware into a bridgehead for further lateral movement within a targeted network. To maintain communication with its operators, ASHVEIN utilizes encrypted command-and-control (C2) channels. In an effort to remain stealthy, the malware has been observed hiding its tasking instructions inside invisible HTML elements, a technique designed to bypass traditional network monitoring tools that might flag more obvious C2 traffic.

Furthermore, ASHVEIN’s developers have implemented a fallback mechanism to ensure the malware remains functional even if its primary C2 infrastructure is taken down. Some variants utilize a GitHub-based "dead drop resolver," where the malware checks a specific, seemingly benign GitHub repository to find the updated address of its control server. This reliance on legitimate web services to mask malicious traffic is a hallmark of sophisticated APT (Advanced Persistent Threat) groups.

The evolution of UAC-0099’s tradecraft is a point of concern for the cybersecurity community. Since its inception, the group has transitioned from relatively simple PowerShell- and Go-based tools to more complex, compiled C# binaries. Modern iterations of their malware often utilize .NET Reactor protection to hinder reverse engineering and are frequently concealed within steganographic image files. By hiding malicious code inside the pixels of an image, the group can move its payloads across networks without triggering alerts from security solutions that only scan for known file signatures.

Research from ESET, published in its November 2025 APT Activity Report, provides additional context on the group’s role within the broader Russian intelligence ecosystem. ESET suggests that UAC-0099 may serve as an initial access broker for Sandworm, the notorious Russian APT group linked to the GRU (Main Intelligence Directorate). Sandworm is globally recognized for its destructive cyberattacks, including the infamous NotPetya incident and multiple strikes against Ukraine’s power grid. If UAC-0099 is indeed functioning as a scout or "door opener" for Sandworm, the deployment of ASHVEIN could be a precursor to more damaging operations.

TrendAI’s analysis of the malware’s development environment indicates a highly organized operation. Researchers identified five distinct builds of ASHVEIN compiled between October 8 and October 23, 2025. These builds utilized three different packing variants, suggesting that the group is actively testing different methods to evade detection. The researchers also noted functional overlaps between ASHVEIN and another malware family used by the group, known as DRAGSTARE. Both tools share capabilities in credential theft, screenshotting, and system fingerprinting via Windows Management Instrumentation (WMI).

Despite these similarities, the two malware families appear to be developed in parallel. DRAGSTARE is linked to a developer account known as "NordDragon" and includes specific features such as anti-virtual machine (VM) checks and subnet scanning. ASHVEIN, meanwhile, is compiled under a separate "dev" account and utilizes a different packing strategy. This division of labor suggests that UAC-0099 maintains multiple development streams to meet various operational requirements, ensuring that if one tool is detected, others remain viable.

The delivery methods for ASHVEIN are as varied as its internal functions. The group frequently employs DLL sideloading—a technique where a malicious DLL is placed in a directory with a legitimate executable, which then unwittingly loads the malware. This specific implementation has been dubbed FORGECLAMP. Other delivery vectors include the use of VHD (Virtual Hard Disk) containers and purpose-built .NET droppers.

One particularly effective dropper identified by researchers is named "AnswerFromPolice." This executable is designed to exploit the trust of its victims by displaying a decoy Microsoft Word document that purports to be an official response from the National Police of Ukraine. While the user is distracted by the credible-looking document, the dropper silently installs ASHVEIN in the background. This combination of institutional impersonation and high-quality decoy content is a classic social engineering tactic, tailored to the high-stress environment of a nation at war.

UAC-0099 has also invested heavily in the refinement of its downloader tools, most notably the MATCHBOIL family. According to ESET researcher Fernando Tavella, MATCHBOIL has been under active development since at least April 2024. Its primary role is to serve as a persistent secondary stage, responsible for downloading and installing further payloads onto a compromised system. Recent versions of MATCHBOIL have appeared as DLL files executed by custom C# loaders, and they incorporate advanced environment checks. For instance, the malware may abort execution if it detects it is running in a virtual environment or if the operating system was installed less than ten days prior to the execution—a common sign of a freshly spun-up sandbox used by security researchers.

Perhaps the most innovative and concerning development in UAC-0099’s arsenal is a technique called "GuardBreaker." Observed by ESET in a campaign against a Ukrainian target, this method is specifically designed to undermine artificial intelligence-assisted security analysis. The group deployed a malicious Visual Basic Script (VBScript) that served as a conduit for MATCHBOIL. Within the script’s code, the developers embedded a specific prompt asking for instructions on how to manufacture a nuclear weapon.

This was not a literal request for information, but rather a calculated attempt to trigger the safety and ethical mechanisms of Large Language Models (LLMs). As more security firms integrate AI into their automated analysis pipelines, threat actors are looking for ways to "poison" the data. By including a "forbidden" prompt within the code, the attackers hope to cause an AI analyzer to refuse to process the file entirely, thereby allowing the malicious script to slip through undetected.

The shifting focus of UAC-0099’s targeting provides a grim reflection of the ongoing conflict. While the group initially prioritized government and military organizations, there has been a noticeable drift toward civilian logistics and infrastructure operators. TrendAI notes that this expansion tracks with the logic of the war itself: as the conflict persists, the strategic value of understanding and disrupting Ukraine’s supply lines and civilian networks increases. The cyber effort is now closely following the same objectives as the kinetic one, aiming to destabilize the networks that keep the country supplied and operational.

As the war in Ukraine continues to drive innovation in both offensive and defensive cyber operations, the emergence of ASHVEIN and the group’s use of AI-evasion techniques like GuardBreaker signal a period of increased technical sophistication. Security organizations remain on high alert, as the blurring lines between initial access brokerage and destructive state-sponsored attacks suggest that the threats facing Ukraine’s digital infrastructure are only becoming more complex.