UAC-0218 phishing campaign targeting Ukraine defense forces
Campaign
Summary
Hide ▲
Show ▼
In H1 2025, UAC-0218 ran a phishing campaign against Ukraine's defense forces, using booby-trapped RAR archives to deliver HOMESTEEL. The operation matters because it shows an active, targeted delivery chain aimed at military victims in an ongoing wartime cyber environment.
Related Happenings
Ghostwriter geofenced PDF spear-phishing campaign targeting Ukrainian government entities
Campaign
H score50
First: 14.05.2026 17:00
Last: 14.05.2026 17:00
Sources 1
About this happening:
The Ghostwriter / FrostyNeighbor group is running a geofenced spear-phishing campaign against government entities in Ukraine, and the operation matters because it deli...
Ghostwriter geofenced PDF spear-phishing campaign targeting Ukrainian government entities
CampaignAbout this happening: The Ghostwriter / FrostyNeighbor group is running a geofenced spear-phishing campaign against government entities in Ukraine, and the operation matters because it deli...
TA416 European government espionage campaign
Campaign
H score32
First: 01.04.2026 15:05
Last: 01.04.2026 15:05
Sources 1
About this happening:
TA416 has resumed cyber espionage activity, targeting European governments and EU/NATO diplomatic missions with a renewed malware-delivery operation that raises cross-...
TA416 European government espionage campaign
CampaignAbout this happening: TA416 has resumed cyber espionage activity, targeting European governments and EU/NATO diplomatic missions with a renewed malware-delivery operation that raises cross-...
Latest development: 03.04.2026 20:34
TA416 expanded its espionage campaign to Middle Eastern government and diplomatic entities after the outbreak of the U.S.-Israel-Iran conflict in late February 2026, while linking to archives hosted on Google Drive or a compromised SharePoint instance to refine its PlugX delivery chain and collect regional intelligence.
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: The FBI warned that Iranian MOIS-linked hackers are using Telegram C2 and social engineering to deliver Windows malware against journalists, dissidents, and ot...
APT28 long-term espionage campaign targeting Ukrainian military personnel
Campaign
H score32
First: 10.03.2026 12:55
Last: 10.03.2026 12:55
Sources 1
About this happening:
A sustained APT28 espionage campaign is using BEARDSHELL and COVENANT to surveil Ukrainian military personnel, extending access through cloud-based C2 and incr...
APT28 long-term espionage campaign targeting Ukrainian military personnel
CampaignAbout this happening: A sustained APT28 espionage campaign is using BEARDSHELL and COVENANT to surveil Ukrainian military personnel, extending access through cloud-based C2 and incr...
UAC-0050 spear-phishing campaign targeting European financial institutions
Campaign
H score29
First: 24.02.2026 16:21
Last: 24.02.2026 16:21
Sources 1
About this happening:
The UAC-0050 spear-phishing operation targeted a European financial institution, raising concern that the actor is extending its reach beyond Ukraine into Western Eu...
UAC-0050 spear-phishing campaign targeting European financial institutions
CampaignAbout this happening: The UAC-0050 spear-phishing operation targeted a European financial institution, raising concern that the actor is extending its reach beyond Ukraine into Western Eu...
Timeline
-
09.10.2025 12:10 2 articles · 9mo ago
UAC-0218 phishing campaign targeting Ukraine defense forces
Initial DisclosureDuring H1 2025, UAC-0218 began phishing waves that used RAR archive lures to deliver HOMESTEEL to defense forces in Ukraine.
Show sources
- From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine — thehackernews.com — 09.10.2025 12:10
- From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine — thehackernews.com — 09.10.2025 12:10