UAC-0226 GIFTEDCROOK Encoded Loader Staged in ProgramData (WC3/wt1)

Ethan Andrews@eandrews

•updated Jun 29, 2026•0•0•6

Detects the creation of files named 'WC3' or 'wt1' within the 'C:\ProgramData' directory. These filenames are associated with the UAC-0226 threat actor's delivery chain, specifically involving an encoded PowerShell loader (WC3) and an arithmetic-encoded GIFTEDCROOK payload (wt1). These files are typically dropped via path traversal exploitation (CVE-2025-8088) using WinRAR NTFS alternate data streams.