UAC-0099 Uses ASHVEIN RAT to Target Ukrainian Government Personnel
Summary
TrendAI attributes ASHVEIN, a .NET infostealer and RAT, to UAC-0099 attacks targeting Ukrainian government personnel. The malware steals credentials, captures screenshots and hides commands in HTML; the actor has also experimented with AI-evasion tactics.
Key points
- ASHVEIN steals credentials from Chrome and Firefox, captures screenshots, retrieves files, runs PowerShell commands and communicates with encrypted C2 servers.
- The malware can hide tasking in invisible HTML elements; some variants use a GitHub-based dead drop resolver.
- Delivery methods include DLL sideloading, VHD containers and .NET droppers. One dropper displays a decoy document impersonating Ukraine’s National Police.
- TrendAI says ASHVEIN overlaps with UAC-0099’s DRAGSTARE malware but was built using a different packing approach and developer account.
- UAC-0099 has also developed MATCHBOIL, a downloader that installs and persists another payload and has checks for virtual environments.
- A VBScript carrying a prompt intended to disrupt AI-assisted code analysis was observed, but current evidence indicates the actor has stopped using the tactic.
- Reporting indicates the actor’s targets have expanded beyond government and military entities to civilian logistics and infrastructure operators in Ukraine.
Article Details
- Attack Vectors
- ASHVEIN is delivered through DLL sideloading, VHD containers, and purpose-built .NET droppers.
- AnswerFromPolice is a .NET executable that displays a decoy document impersonating the National Police of Ukraine while deploying malware in the background.
- Some ASHVEIN variants use a GitHub-based dead drop resolver as a fallback mechanism.
- A malicious VBScript serves as a conduit for MATCHBOIL and embeds a prompt intended to interfere with AI-assisted code analysis.
MITRE ATT&CK
T1027.003 · SteganographyThe article says UAC-0099 concealed compiled binaries within steganographic image files.T1059.001 · PowerShellASHVEIN supports remote shell execution through PowerShell.T1082 · System Information DiscoveryASHVEIN performs system fingerprinting, including WMI fingerprinting.T1083 · File and Directory DiscoveryASHVEIN enumerates files and can retrieve them.T1113 · Screen CaptureASHVEIN captures screenshots using GDI.T1497.001 · System ChecksMATCHBOIL checks whether it is running in a virtual environment and may abort execution.T1555.003 · Credentials from Web BrowsersASHVEIN steals credentials from Chrome and Firefox.T1574.002 · DLL Side-LoadingUAC-0099 delivers ASHVEIN using DLL sideloading, also referred to in the article as FORGECLAMP.
People
Threat Actors
Malware
AnswerFromPolice(aka FORGECLAMP), VHD containers, and purpose-built .NET droppers. One such .NET executable is AnswerFromPolice, which embeds a Microsoft Word document that purports to be a response from the National Police ofASHVEINThe Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.DRAGSTARE23, 2025, across three distinct packing variants," TrendAI said. "ASHVEIN overlaps functionally with DRAGSTARE in credential theft, screenshots, file collection, and WMI fingerprinting, but key differences separateMatchBoilAnother malware family that has undergone extensive evolution over the past year is MATCHBOIL. ESET's research indicates that the C# downloader has been under active development since at least April 2024. MATCHBOIL'sTelemetryBrowserASHVEIN, which its developers internally refer to as "TelemetryBrowser," brings together credential theft, surveillance, and remote-control capabilities. Its functionality includes credential theft from Chrome and
Products
Google Chrometheft, surveillance, and remote-control capabilities. Its functionality includes credential theft from Chrome and Firefox, GDI-based screenshot capture, file enumeration and retrieval, PowerShell remote shellMicrosoft Wordand purpose-built .NET droppers. One such .NET executable is AnswerFromPolice, which embeds a Microsoft Word document that purports to be a response from the National Police of Ukraine.Mozilla Firefoxand remote-control capabilities. Its functionality includes credential theft from Chrome and Firefox, GDI-based screenshot capture, file enumeration and retrieval, PowerShell remote shell execution, systemPowerShellcredential theft from Chrome and Firefox, GDI-based screenshot capture, file enumeration and retrieval, PowerShell remote shell execution, system fingerprinting, and encrypted command-and-control (C2) communications.
Countries
RussiaThe Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan (RAT) codenamed ASHVEIN.UkraineUAC-0099 was first documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in June 2023. It has a history of targeting Ukrainian government, defense, border guard, and logistics entities since at least
Industries
Border guardTeam of Ukraine (CERT-UA) in June 2023. It has a history of targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022, emerging in the wake of Russia's full-scale invasionDefenseResponse Team of Ukraine (CERT-UA) in June 2023. It has a history of targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022, emerging in the wake of Russia'sGovernmentAccording to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company is tracking the cluster under the name Earth Sirrush (previously SHADOW-EARTH-065).Infrastructuretargeting has expanded beyond government and military organizations to include civilian logistics and infrastructure operators that keep Ukraine supplied," TrendAI said. "That drift tracks the war: As the conflictlogistics(CERT-UA) in June 2023. It has a history of targeting Ukrainian government, defense, border guard, and logistics entities since at least mid-2022, emerging in the wake of Russia's full-scale invasion of Ukraine.