UAC-0247 phishing-led malware campaign targeting Ukrainian government and healthcare institutions
Campaign
Summary
Hide ▲
Show ▼
A March-April 2026 UAC-0247 phishing campaign targeted Ukrainian government and municipal healthcare organizations, using malware delivery to steal data from Chromium-based browsers and WhatsApp. The operation matters because it combined social engineering, multi-stage loaders, and credential theft against public-sector and clinical victims.
Related Happenings
AgingFly malware attacks local governments and hospitals in Ukraine
Malware Activity
H score28
First: 16.04.2026 00:57
Last: 16.04.2026 00:57
Sources 1
About this happening:
The AgingFly malware is now being deployed against local governments and hospitals in Ukraine, where it steals browser and WhatsApp authentication data and enables dee...
AgingFly malware attacks local governments and hospitals in Ukraine
Malware ActivityAbout this happening: The AgingFly malware is now being deployed against local governments and hospitals in Ukraine, where it steals browser and WhatsApp authentication data and enables dee...
NCSC alert on messaging-app targeting of high-risk individuals
Public Sector Action
H score30
First: 02.04.2026 17:15
Last: 02.04.2026 17:15
Sources 1
About this happening:
The UK National Cyber Security Centre (NCSC) issued a March 31 alert warning that Russia-based actors were targeting high-risk individuals through messaging apps,...
NCSC alert on messaging-app targeting of high-risk individuals
Public Sector ActionAbout this happening: The UK National Cyber Security Centre (NCSC) issued a March 31 alert warning that Russia-based actors were targeting high-risk individuals through messaging apps,...
UAC-0255 CERT-UA impersonation phishing campaign
Campaign
H score51
First: 01.04.2026 19:10
Last: 01.04.2026 19:10
Sources 1
About this happening:
The UAC-0255 phishing campaign impersonated CERT-UA to deliver a password-protected ZIP archive and trick recipients into installing AGEWHEEZE. The operation ran on ...
UAC-0255 CERT-UA impersonation phishing campaign
CampaignAbout this happening: The UAC-0255 phishing campaign impersonated CERT-UA to deliver a password-protected ZIP archive and trick recipients into installing AGEWHEEZE. The operation ran on ...
WhatsApp-delivered VBS Windows infection campaign
Campaign
H score34
First: 01.04.2026 14:49
Last: 01.04.2026 14:49
Sources 1
About this happening:
A new WhatsApp-delivered campaign is spreading malicious VBS files that launch a multi-stage Windows infection chain, raising the risk of persistence and remote access...
WhatsApp-delivered VBS Windows infection campaign
CampaignAbout this happening: A new WhatsApp-delivered campaign is spreading malicious VBS files that launch a multi-stage Windows infection chain, raising the risk of persistence and remote access...
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Timeline
-
16.04.2026 09:20 2 articles · 3mo ago
CERT-UA discloses UAC-0247 phishing-led malware campaign
Initial DisclosureCERT-UA disclosed a UAC-0247 campaign against Ukrainian governments and municipal healthcare institutions, mainly clinics and emergency hospitals, that was observed between March and April 2026 and used a humanitarian-aid phishing lure, LNK and HTA execution via mshta.exe, and loaders such as RAVENSHELL, AGINGFLY, and SILENTLOOP to steal data from Chromium-based browsers and WhatsApp. The activity enabled reconnaissance, lateral movement, credential theft, and other sensitive-data theft, and investigators said representatives of the Defense Forces of Ukraine may also have been targeted through malicious ZIP archives sent via Signal. CERT-UA also recommended restricting execution of LNK, HTA, and JS files and limiting use of mshta.exe, powershell.exe, and wscript.exe to reduce exposure.
Show sources
- UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign — thehackernews.com — 16.04.2026 09:20
- UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign — thehackernews.com — 16.04.2026 09:20