Executive Summary
UAC-0184 (also known as MB-0007) has been identified in a sophisticated campaign targeting Ukrainian military entities. The attack begins with social engineering lures delivered via messengers and dating platforms, utilizing Ukraine-themed LNK files that trigger a multi-stage infection chain. The group demonstrates high technical proficiency by employing gated delivery mechanisms, custom obfuscation techniques such as 'pseudo-PNG' file abuse, and multiple layers of DLL sideloading.
Technically, the actor leverages legitimate binaries like Plane9 and Microsoft's VSLauncher.exe to sideload malicious components. A notable aspect of this campaign is the bundling of 'PassMark Endpoint,' a signed network utility, to provide a legitimate-looking network stack for C2 communication and process dumping (via MiniDumpWriteDump). By using signed utilities, UAC-0184 effectively masks its network footprint and execution, making detection significantly more difficult for traditional security solutions.
This activity reflects a broader trend of leveraging trusted infrastructure and signed third-party binaries to bypass endpoint protections. Given the group's focus on document and messenger data theft from defense-related targets, the urgency for organizations within the Ukrainian defense sector to implement the recommended detections is high.