CERT-UA Reports UAC-0247 Campaign Targeting Ukrainian Hospitals and Government
Summary
CERT-UA reported a March–April 2026 surge in UAC-0247 activity targeting Ukrainian hospitals, emergency services, municipalities and defense-linked users, using humanitarian-aid phishing, malware and credential theft.
Key points
- CERT-UA linked a reported increase in attacks between March and April 2026 to threat cluster UAC-0247.
- Phishing emails disguised as humanitarian aid deliver malicious LNK files that abuse Windows tools to execute remote code.
- The reported infection chain uses multi-stage loaders, encrypted payloads, scheduled tasks and process injection.
- CERT-UA reported AGINGFLY and SILENTLOOP for persistent access and remote control, alongside RAVENSHELL-like reverse shells.
- Reported tools include CHROMELEVATOR for browser credential theft, ZAPIXDESK targeting WhatsApp data, and LIGOLO-NG and CHISEL for tunneling.
- In one reported case, a modified WireGuard application contained an XMRIG miner; defense-linked users were also targeted with trojanized drone-operator software.
- CERT-UA recommends restricting high-risk file types such as LNK, HTA and JavaScript, and limiting use of mshta.exe and PowerShell where possible.
Article Details
- Event Type
- Reported phishing-led cyber campaign attributed by CERT-UA to UAC-0247, targeting Ukrainian hospitals, emergency services, municipal bodies, and defense-linked users.
- Impact
- The reported activity used malicious files and multi-stage loaders to establish remote access and persistence. The article says the attackers used tools for credential theft, lateral movement, and cryptocurrency mining; AGINGFLY is described as enabling file exfiltration, screenshot capture, and keylogging. The article does not quantify affected organizations or confirmed losses.
MITRE ATT&CK
T1053.005 · Scheduled TaskMalicious executables were deployed via scheduled tasks.T1055 · Process InjectionThe article reports code injection into legitimate processes, including RuntimeBroker.exe.T1056.001 · KeyloggingAGINGFLY is described as supporting keylogging.T1059.001 · PowerShellThe article describes SILENTLOOP as a PowerShell-based tool used to maintain persistence and retrieve command-server addresses.T1113 · Screen CaptureAGINGFLY is described as supporting screenshot capture.T1555.003 · Credentials from Web BrowsersCHROMELEVATOR was reportedly used to extract browser credentials.T1566.002 · Spearphishing LinkCERT-UA reported phishing emails disguised as humanitarian assistance that directed recipients to links.T1572 · Protocol TunnelingThe article says LIGOLO-NG and CHISEL tunneling tools were used for stealthy movement across networks.T1574.002 · DLL Side-LoadingA trojanized application for FPV drone operators reportedly used DLL side-loading to install AGINGFLY.
Threat Actors
Malware
Products
Microsoft WindowsPhishing emails posing as humanitarian aid deliver malicious LNK files that abuse Windows tools to execute remote code.SignalCERT-UA noted an incident in March where individuals connected to Ukraine’s defense sector were targeted via the Signal platform.WireGuardIn at least one case, attackers went further—embedding the XMRIG cryptocurrency miner inside a modified version of the legitimate WireGuard application, highlighting a secondary motive of financial gain.
Tools
ChiselCredential theft (CHROMELEVATOR, ZAPIXDESK), tunneling tools (LIGOLO-NG, CHISEL), and trojanized software enable lateral movement and monetization like XMRIG mining.ChromElevatorCredential theft (CHROMELEVATOR, ZAPIXDESK), tunneling tools (LIGOLO-NG, CHISEL), and trojanized software enable lateral movement and monetization like XMRIG mining.Ligolo-ngCredential theft (CHROMELEVATOR, ZAPIXDESK), tunneling tools (LIGOLO-NG, CHISEL), and trojanized software enable lateral movement and monetization like XMRIG mining.rustscanThe attackers also conduct internal reconnaissance using both custom scripts and publicly available tools such as RUSTSCAN.SILENTLOOPAttackers deploy multi-stage loaders, custom executable formats and backdoors like AGINGFLY—alongside tools such as SILENTLOOP and RAVENSHELL—to gain persistent remote control, steal credentials, and deploy cryptominers.XMRigCredential theft (CHROMELEVATOR, ZAPIXDESK), tunneling tools (LIGOLO-NG, CHISEL), and trojanized software enable lateral movement and monetization like XMRIG mining.ZAPIXDESKCredential theft (CHROMELEVATOR, ZAPIXDESK), tunneling tools (LIGOLO-NG, CHISEL), and trojanized software enable lateral movement and monetization like XMRIG mining.
Countries
Industries
Defensecampaign by threat cluster UAC-0247 targeting hospitals, emergency services, municipal bodies, and defense-linked users with phishing lures disguised as humanitarian aid.Emergency Servicescyber defenders warned of an intensified campaign by threat cluster UAC-0247 targeting hospitals, emergency services, municipal bodies, and defense-linked users with phishing lures disguised as humanitarian aid.Governmentreported a newly intensified cyber campaign that is targeting Ukraine’s healthcare system and local government agencies, with attackers deploying increasingly sophisticated malware and social engineering tactics.HealthcareUkrainian cyber defenders reported a newly intensified cyber campaign that is targeting Ukraine’s healthcare system and local government agencies, with attackers deploying increasingly sophisticated malware and social