Executive Summary
The Russia-aligned threat actor UAC-0099, tracked as Earth Sirrush, has deployed a previously undocumented .NET infostealer and RAT called ASHVEIN (internally named TelemetryBrowser) in targeted attacks against Ukrainian government personnel since October 2025. The malware features credential theft capabilities for Chrome and Firefox browsers, screenshot capture, file enumeration, PowerShell remote shell execution, and encrypted command-and-control communications that hide tasking inside invisible HTML elements. UAC-0099 has been actively targeting Ukrainian government, defense, border guard, and logistics entities since mid-2022 following Russia's invasion, serving as an initial access broker for the destructive Sandworm APT group.
This incident demonstrates the continued evolution of state-sponsored cyber espionage capabilities targeting critical infrastructure during ongoing geopolitical conflicts. The threat actor's shift from PowerShell-based tools to sophisticated .NET malware with anti-analysis features, including GuardBreaker techniques designed to fool AI-assisted security analysis, represents a significant advancement in evasion tactics that security teams worldwide must prepare to counter.
Why This Matters Now
State-sponsored actors are rapidly evolving their tradecraft to evade AI-powered security tools, with UAC-0099's GuardBreaker technique specifically designed to trigger LLM safety mechanisms and prevent automated analysis, signaling a new frontier in the cat-and-mouse game between attackers and defenders.
Attack Path Analysis
UAC-0099 delivered ASHVEIN RAT through spear-phishing emails with malicious attachments (VHD containers, DLL sideloading) targeting Ukrainian government personnel. The malware established persistence through .NET droppers, escalated privileges via credential theft from browsers, moved laterally through stolen credentials, maintained command and control via encrypted C2 communications with GitHub dead drop resolvers, exfiltrated sensitive government data including screenshots and files, and achieved sustained espionage impact for intelligence collection supporting Russian military operations.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Spear-phishing emails delivered malicious VHD containers and .NET droppers like AnswerFromPolice impersonating Ukrainian National Police documents to government personnel
MITRE ATT&CK® Techniques
Spearphishing Attachment
Portable Executable Injection
Credentials from Web Browsers
Screen Capture
Embedded Payloads
Ingress Tool Transfer
PowerShell
DLL Side-Loading
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques for Bespoke and Custom Software
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
DORA – ICT Risk Management Framework
Control ID: Article 11
CISA ZTMM 2.0 – Credential Management
Control ID: Identity.AM-6
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2(a)
GDPR – Security of Processing
Control ID: Article 32
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
Primary target of UAC-0099 APT group using ASHVEIN RAT for credential theft and surveillance against Ukrainian government personnel, requiring enhanced Zero Trust segmentation and threat detection capabilities.
Defense/Space
Critical infrastructure targeted by Russia-aligned threat actor for espionage operations, necessitating encrypted traffic controls, east-west security monitoring, and egress policy enforcement to prevent data exfiltration.
Logistics/Procurement
Expanding target scope includes civilian logistics operators supporting Ukraine supply chains, vulnerable to credential theft and surveillance through .NET malware requiring multicloud visibility and anomaly detection.
Law Enforcement
Social engineering attacks impersonating National Police of Ukraine through malicious documents deploying ASHVEIN malware, demanding enhanced threat detection and secure hybrid connectivity for protection against institutional impersonation.
Sources
- UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTMLhttps://thehackernews.com/2026/10/uac-0099-targets-ukrainian-government.htmlVerified
- Earth Sirrush: Russia-aligned Intrusion Set 4 Years Evolving Espionage Toolinghttps://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/earth-sirrush-russia-aligned-intrusion-set-4-years-evolving-espionage-toolingVerified
- MATCHBOIL New Tricks Same Old Evil Intentionshttps://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/Verified
- CERT-UA UAC-0099 Threat Actor Documentationhttps://cert.gov.ua/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained UAC-0099's lateral movement and data exfiltration capabilities across Ukrainian government networks. The segmented architecture and controlled egress policies would likely have reduced the attacker's blast radius and limited their ability to access sensitive intelligence data.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial compromise through email may still occur, CNSF workload isolation would likely limit the attacker's ability to establish persistence across multiple government cloud environments and constrain the initial foothold to specific segmented workloads.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the effectiveness of stolen browser credentials by limiting access to identity-scoped resources and reducing the attacker's ability to escalate privileges across segmented government network zones.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely block unauthorized lateral movement attempts using stolen credentials and constrain PowerShell remote shell access between segmented government network zones, significantly reducing the attacker's ability to traverse the network infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility controls would likely detect anomalous outbound connections to GitHub dead drop resolvers and constrain the attacker's ability to maintain persistent command and control channels across the government's multicloud infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policies would likely constrain large-scale data exfiltration by blocking unauthorized outbound transfers and limiting the attacker's ability to transmit government files and screenshots through encrypted channels to external Russian intelligence infrastructure.
While some government intelligence data might still be compromised, the blast radius would likely be significantly reduced to specific segmented workloads, limiting the strategic intelligence value available to support Russian military and logistics planning operations.
Impact at a Glance
Affected Business Functions
- Government Administrative Services
- Defense Operations
- Border Security Systems
- Logistics and Supply Chain
Estimated downtime: 7 days
Estimated loss: $500,000
Classified government documents, defense intelligence, personnel credentials from Chrome and Firefox browsers, system screenshots containing sensitive information, and operational communications from Ukrainian government, defense, and border guard entities
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Egress Security & Policy Enforcement to block encrypted C2 communications and prevent data exfiltration to unauthorized external destinations
- • Implement Zero Trust Segmentation with least privilege policies to prevent lateral movement across government network segments using stolen credentials
- • Enable Multicloud Visibility & Control to detect anomalous C2 traffic patterns and GitHub-based dead drop resolver communications
- • Deploy Threat Detection & Anomaly Response capabilities to identify credential harvesting activities and suspicious PowerShell execution patterns
- • Implement East-West Traffic Security controls to monitor and restrict workload-to-workload communications within government infrastructure
