UAC-0226
UAC-0226 is a Russia-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets the Government, and Defense and Aerospace sectors in Ukraine. It uses 6 MITRE ATT&CK techniques.
- Origin
- Russia
- Techniques
- 6
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2025
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
6 techniques across 5 of 14 tacticsReconnaissance·
Resource Development·
Initial Access1
User Execution: Malicious File
Persistence1
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion1
Hide Artifacts: NTFS File Attributes
Credential Access1
Credentials from Password Stores: Credentials from Web Browsers
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Vulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- GIFTEDCROOKmalware
- PowerShelltool
- WinRARtool
Indicators Of Compromise.
TLP:AMBER4 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout UAC-0226.
UAC-0226 is a cyber-espionage group targeting Ukrainian military, law enforcement, and local government entities, particularly near the eastern border, since February 2025. Initial access is achieved via phishing emails containing malicious.xlsm documents that decode and execute base64-encoded payloads stored in spreadsheet cells. Two main tools are used: a.NET-based reverse shell leveraging PowerShell code from a public GitHub repository ( and GIFTEDCROOK, a C/C++ stealer that extracts browser data (cookies, history, credentials), archives it with PowerShell, and exfiltrates via Telegram. The group often abuses compromised webmail accounts for delivery, underlining the importance of detailed email and web server logging. Their activity shows a mix of low development overhead and high operational targeting, consistent with state-aligned espionage.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.