Earth Sirrush: Russia-Aligned Espionage Evolution Targeting Ukraine

Earth Sirrush (overlapping with CERT-UA's UAC-0099) is a Russia-aligned threat actor active since at least 2022, targeting Ukrainian government, defense, and logistics organizations. The group has demonstrated significant maturity, evolving from early PowerShell and Go tools to sophisticated .NET-based implants like ASHVEIN and CINDERBLOT. There are reported assessments suggesting UAC-0099 may conduct initial access operations for the Sandworm (APT44) group.

The intrusion set employs diverse delivery methods including spear-phishing lures impersonating the National Police of Ukraine and the State Border Guard Service, steganography-embedded payloads in PNG files, and trojanized software such as Notepad++ plugins. Technical analysis reveals a shared development environment and infrastructure, characterized by consistent WMI fingerprinting queries, XOR string encryption seeds, and backend infrastructure clustering in AS399629 (BL Networks).

This activity represents a persistent intelligence-collection threat rather than destructive actions. The actor's ability to maintain access across offline periods and their shift toward targeting civilian supply chains and logistics indicates a strategic alignment with kinetic military objectives, making them a high-priority threat for Ukrainian critical infrastructure and their partners.