UAC-0226 Ukrainian Military Decoy PDF Lure with Weaponized RAR and LNK

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects host-based activity related to known UAC-0226 campaign artifacts, including specific decoy PDF filenames and malicious LNK file names found in command-line arguments or file system events (FileName, TargetFilename).