Cybersecurity
UAC-0099 used ASHVEIN against Ukrainian government personnel
TrendAI said the Russia-aligned UAC-0099 cluster used ASHVEIN against Ukrainian government personnel, while ESET and CERT-UA placed the group within a longer campaign against Ukrainian state and logistics targets.
- TrendAI said UAC-0099 had used ASHVEIN against Ukrainian government personnel and tracked the cluster as Earth Sirrush, previously SHADOW-EARTH-065.
- ASHVEIN was a .NET infostealer and remote access trojan internally called TelemetryBrowser; it stole browser credentials, captured screenshots, enumerated files, executed PowerShell shells, fingerprinted systems and used encrypted command-and-control.
- CERT-UA first documented UAC-0099 in June 2023, and ESET said it had targeted Ukrainian government, defence, border guard and logistics entities since at least mid-2022.
- ESET said UAC-0099 could act as an initial access broker for Sandworm, and TrendAI said the group's toolkit had shifted towards compiled C# and .NET binaries over time.
- Fernando Tavella said a malicious VBScript had used a prompt about making a nuclear weapon to trigger large language model safety checks, but he said the actor was no longer using that method before malware delivery.
TrendAI said ASHVEIN had been deployed in attacks on Ukrainian government personnel. It said the malware concealed its commands in hidden HTML and that some variants used a GitHub-based fallback resolver, while delivery also came through DLL sideloading, VHD containers and dedicated .NET droppers.
The company described ASHVEIN as a tool for credential theft, screen capture, file collection, remote shell execution, system fingerprinting and encrypted command-and-control. It said the malware was developed internally as TelemetryBrowser.
CERT-UA first documented UAC-0099 in June 2023, and ESET said the group had targeted Ukrainian government, defence, border guard and logistics entities since at least mid-2022. ESET also said the crew could provide initial access for Sandworm, a Russian APT group.
TrendAI and ESET said the group's tooling had changed over time, with families including LONEPAGE, MATCHBOIL, DRAGSTARE, BadPaw, MeowMeow, LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 appearing across 2022 to 2026. The reporting also tied AnswerFromPolice to a decoy document that impersonated the National Police of Ukraine while the malware was deployed in the background.
Tavella said a malicious VBScript had tried to provoke model safety filters with a prompt about making a nuclear weapon, apparently to slow analysis. He said current visibility suggested that the tactic had been short-lived and was no longer used before the malware was delivered.
Named in this story
Companies
- TrendAI
- cybersecurity company that attributed ASHVEIN and named the cluster Earth Sirrush
- ESET
- cybersecurity company that linked the group to Sandworm and tracked MATCHBOIL
Organisations
- UAC-0099
- Russia-aligned threat actor attributed to the ASHVEIN campaign
- Earth Sirrush
- TrendAI's name for the cluster, previously SHADOW-EARTH-065
- Sandworm
- Russian advanced persistent threat group that UAC-0099 may help with initial access
Governments and agencies
- CERT-UA
- Ukrainian emergency response team that first documented UAC-0099 in June 2023
- National Police of Ukraine
- body impersonated in the decoy document
Products and systems
- ASHVEIN
- previously undocumented .NET infostealer and remote access trojan used in the attacks
- LONEPAGE
- PowerShell-based loader listed among the group's earlier tools
- MATCHBOIL
- C# downloader that installs and persists another payload
- DRAGSTARE
- C# information stealer with functional overlap to ASHVEIN
- BadPaw
- .NET loader observed in February to April 2026
- MeowMeow
- backdoor observed in February to April 2026
- LUNCHPOKE
- .NET DLL that masqueraded as a Notepad++ plugin
- BURNYBEAR
- .NET-based loader observed in April to July 2026
- MATCHBOIL.V2
- updated version of MATCHBOIL
- AnswerFromPolice
- .NET executable that embedded a decoy Word document
- GuardBreaker
- technique used in a VBScript to trigger model safety filters
Places
- Ukraine
- country whose government and infrastructure targets were named in the reporting
How the source tells it
The piece used a restrained threat-intelligence register, with alarm and novelty carried mostly by researchers' descriptions of new malware, changing toolsets and a model-jamming trick.
- urgency through repeated references to active attacks, widening targeting and changing tradecraft
- novelty through emphasis on newly documented malware, successive variants and first documented sightings