(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

• giftedcrook?
• What are the specific Indicators of Compromise (IoCs) associated with GIFTEDCROOK infections?
• Are there any known overlaps or shared infrastructure between UAC-0226 and other threat groups targeting Ukraine?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

TL;DR

Key Points

1. • UAC-0226 is conducting targeted cyber-espionage against Ukrainian military, law enforcement, and government entities, leveraging spear-phishing with macro-enabled Excel and signed RDP files.
   • Defenders should prioritize advanced phishing detection, user training, and EDR solutions tuned for GIFTEDCROOK behaviors and Telegram-based exfiltration.
2. • GIFTEDCROOK malware has rapidly evolved from a browser data stealer to a multi-functional intelligence platform, now exfiltrating a broad range of sensitive files via encrypted Telegram bot channels.
   • Network monitoring for Telegram API traffic and strict access controls are critical to detect and contain ongoing intrusions.
3. • Campaigns are closely aligned with Ukrainian geopolitical events, such as peace negotiations and martial law extensions, indicating strategic timing and adaptive social engineering.
   • Security teams should anticipate lures themed around current military and administrative developments and prepare incident response plans accordingly.

Executive Summary

UAC-0226, a threat cluster tracked by CERT-UA has intensified cyber-espionage operations against Ukrainian military, law enforcement, and government institutions since early 2025. The group’s campaigns are tightly coupled with key geopolitical events, exploiting periods of heightened tension and administrative change to maximize impact.

The primary infection vectors are spear-phishing emails containing macro-enabled Excel attachments and signed RDP files, often themed around military mobilization and administrative fines. These lures are contextually tailored to Ukraine’s ongoing conflict and political climate, increasing their effectiveness.

Central to UAC-0226’s toolkit is the GIFTEDCROOK malware, which has evolved from a basic browser data stealer to a sophisticated intelligence-gathering platform. Recent versions (v1.3) feature targeted file collection (including .docx, .pdf, .ovpn), sleep evasion, and encrypted exfiltration via Telegram bot APIs. This technical evolution, combined with stealthy exfiltration methods, poses significant detection and response challenges.

The group’s operations have resulted in the compromise of sensitive data, including administrative documents and VPN configurations, potentially enabling persistent access and further intrusions. While explicit nation-state attribution remains unconfirmed, UAC-0226’s TTPs and targeting patterns are consistent with state-sponsored espionage.

Defensive recommendations include advanced phishing detection, continuous user awareness training, EDR deployment with behavioral detection for GIFTEDCROOK, network segmentation, and monitoring for Telegram-based exfiltration. Incident response plans should be tailored to espionage scenarios, with rapid containment and forensic capabilities.

Looking ahead, UAC-0226 is expected to further enhance GIFTEDCROOK’s capabilities, expand targeting, and refine social engineering in alignment with Ukraine’s evolving geopolitical landscape. Security teams should remain vigilant for new malware variants, increased phishing activity, and signs of lateral movement facilitated by RDP access. Proactive threat hunting, cross-agency intelligence sharing, and adoption of robust cybersecurity frameworks are essential to counter this persistent and adaptive threat.

Research & Attribution

Historical Context

UAC-0226 is a cyber-espionage group identified by the Computer Emergency Response Team of Ukraine (CERT-UA) as active since early 2025. The group intensified operations during Ukraine's peace negotiations and martial law extensions in 2025, leveraging heightened tensions and administrative changes to conduct targeted espionage.

Timeline

• Early 2025:
  • UAC-0226 begins campaigns targeting Ukrainian military, law enforcement, and government institutions.
  • Deployment of GIFTEDCROOK malware via spear-phishing with macro-enabled Excel files and malicious RDP files.
• Mid-2025:
  • GIFTEDCROOK evolves from a browser data stealer to a comprehensive intelligence-gathering platform.
  • Campaigns align with Ukraine's peace negotiations and martial law extensions, increasing targeting intensity.

Origin

UAC-0226 is attributed by CERT-UA to a threat cluster focused on Ukrainian institutions. The group employs sophisticated social engineering and malware techniques consistent with state-sponsored cyber-espionage actors, though explicit nation-state attribution remains unconfirmed. CERT-UA states, "The activity is aimed at military formations, law enforcement agencies, and local self-government bodies, particularly those located near Ukraine's eastern border." Attribution is based on observed TTPs and targeting patterns, with no direct public confirmation of a sponsoring nation.

Countries Targeted

1. Ukraine – Primary target, focusing on military, law enforcement, and government sectors amid geopolitical tensions. As of July 2025, other targets are not publicly documented.

Sectors Targeted

1. Military – Targeted for intelligence on defense operations and mobilization.
2. Law Enforcement – Targeted for insights into internal security and policing.
3. Government – Targeted for administrative and policy-related intelligence.
4. Local Government – Especially in eastern Ukraine, to monitor regional governance.

Motivation

UAC-0226 is motivated by cyber-espionage, aiming to gather intelligence to influence or gain advantage in Ukraine's ongoing conflict and political negotiations. The group seeks sensitive information from military and government entities to support strategic decision-making by their sponsors.

Attack Types

• Spear-phishing with macro-enabled Excel attachments and PDF lures referencing military mobilization and administrative topics.
• Use of signed Remote Desktop Protocol (RDP) files to establish stealthy remote access.
• Deployment of GIFTEDCROOK malware, which evolved from a browser data stealer to a multi-functional intelligence-gathering tool.
• Exfiltration of stolen data via Telegram bot channels.
• Social engineering tailored to Ukrainian geopolitical and military contexts.

Technical Evolution of GIFTEDCROOK Malware

• Version 1.0: Stole browser data such as cookies, login data, and browsing history from Chrome, Edge, and Firefox.
• Version 1.2: Expanded to targeted file collection based on extensions and modification dates, with encrypted archives for exfiltration.
• Version 1.3: Combined previous capabilities, increased file modification window to 45 days, added sleep evasion techniques, and enhanced exfiltration via Telegram bots.

The malware uses social engineering lures themed around military conscription and administrative fines, exploiting the heightened mobilization context in Ukraine. Exfiltration via Telegram bot channels is notable for stealth and operational security.

Impact on Ukrainian Institutions

The campaigns have compromised sensitive data from Ukrainian military, law enforcement, and government bodies, potentially undermining operational security and strategic decision-making. The theft of OpenVPN configurations and administrative documents suggests the threat actor aims to maintain persistent access and conduct further intrusions.

Known Overlaps or Coordination

No direct links to other APT groups have been publicly confirmed. However, CERT-UA tracks similar clusters such as UAC-0219 and UAC-0200 targeting Ukraine with comparable tactics, indicating a multi-group threat environment. Shared email infrastructure with other malware campaigns suggests possible operational overlaps or coordinated targeting efforts.

Recommendations for Strategic Defense and Policy Responses

• Implement advanced phishing detection and user training focused on macro-enabled attachments and RDP file risks.
• Deploy Endpoint Detection and Response (EDR) solutions capable of detecting GIFTEDCROOK behaviors and anomalous RDP activity.
• Monitor network traffic for Telegram API communications indicative of data exfiltration.
• Enforce network segmentation and strict access controls to limit lateral movement.
• Foster collaboration between CERT-UA, allied cybersecurity agencies, and private sector partners for intelligence sharing.
• Conduct regular internal phishing simulations and promote a culture of security awareness.
• Adopt cybersecurity frameworks such as NIST Cybersecurity Framework and CIS Controls to guide defense measures.
• Prepare incident response plans tailored to espionage campaigns with rapid containment and forensic capabilities.

Similar Threat Actor Groups

1. UAC-0219 – CERT-UA tracked cluster targeting Ukrainian institutions with similar phishing and malware tactics.
2. UAC-0200 – CERT-UA tracked cluster with cyber espionage operations against Ukrainian critical infrastructure and government.

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Recommendations, Actions, and Next Steps

1. Enhance Phishing Detection and User Awareness Training Focused on Macro-Enabled Attachments and RDP Files

   • Deploy advanced email security solutions with heuristic and signature-based detection to identify spear-phishing emails containing macro-enabled Excel files and signed RDP files, which are primary infection vectors for UAC-0226’s GIFTEDCROOK malware. Implement continuous, scenario-based user training emphasizing the risks of opening attachments related to military mobilization and administrative topics, reflecting the social engineering themes exploited by the threat actor.
   • This directly mitigates the initial compromise vector, reducing successful malware deployment and lateral movement opportunities.
   • Challenges include maintaining user engagement over time and updating training content to keep pace with evolving phishing tactics. Integration with existing email gateways and security information and event management (SIEM) systems may require tuning.
   • Measure success by tracking reductions in phishing click rates during simulations, increased user reporting of suspicious emails, and decreased incidence of macro-enabled attachment infections.
   • MITRE ATT&CK IDs: T1566 (Phishing), T1204 (User Execution), T1193 (Spearphishing Attachment).

2. Deploy and Tune Endpoint Detection and Response (EDR) with Network Monitoring for Telegram-Based Exfiltration

   • Implement EDR solutions capable of detecting GIFTEDCROOK’s evolving behaviors, including targeted file collection based on extensions and modification dates, sleep evasion techniques, and anomalous RDP activity. Complement endpoint telemetry with network monitoring focused on detecting Telegram API traffic patterns used for stealthy data exfiltration, leveraging known indicators of compromise (IOCs) such as suspicious Telegram bot communications.
   • This layered detection approach enables early identification and containment of espionage activities, reducing data loss and operational impact.
   • Challenges include tuning detection rules to minimize false positives and ensuring visibility into encrypted or proxied network traffic. Collaboration with network teams is essential to deploy appropriate monitoring sensors.
   • Success metrics include the number of detected and blocked malware activities, alerts on suspicious Telegram traffic, and reduced dwell time of intrusions.
   • MITRE ATT&CK IDs: T1021.001 (Remote Services: Remote Desktop Protocol), T1041 (Exfiltration Over C2 Channel), T1059 (Command and Scripting Interpreter).

3. Strengthen Network Segmentation, Access Controls, and Incident Response Preparedness with Executive Sponsorship

   • Enforce strict network segmentation to isolate critical military, law enforcement, and government systems, limiting lateral movement. Implement role-based access controls (RBAC) and multi-factor authentication (MFA) to reduce unauthorized access risks. Develop and regularly update incident response plans tailored to espionage campaigns, including rapid containment, forensic analysis, and recovery. Secure executive sponsorship to ensure cross-departmental coordination and resource allocation. Integrate these efforts with national-level cyber defense initiatives and allied intelligence sharing frameworks.
   • These measures reduce the impact of successful intrusions and improve organizational resilience against persistent espionage threats like UAC-0226.
   • Challenges include potential operational disruptions during segmentation implementation and the need for continuous training and exercises to maintain incident response readiness.
   • Measure effectiveness by reduced lateral movement incidents, audit logs showing adherence to access policies, and performance in incident response exercises.
   • MITRE ATT&CK IDs: T1078 (Valid Accounts), T1562 (Impair Defenses), T1601 (Disk Wipe).

Suggested Pivots

1. What are the specific indicators of compromise (IOCs) and behavioral patterns associated with the latest GIFTEDCROOK v1.3 malware that can be integrated into detection and response tools to improve early identification of UAC-0226 intrusions? This question is grounded in Arctic Wolf Labs' findings that GIFTEDCROOK has evolved into a sophisticated intelligence-gathering tool with enhanced file targeting and exfiltration via Telegram, posing new detection challenges.

2. How can natural language processing (NLP) and timeline analysis of phishing lure content and delivery patterns be leveraged to predict future social engineering themes and campaign timings used by UAC-0226? This is based on observed correlations between phishing lures themed around military mobilization and administrative topics and Ukraine's geopolitical events, suggesting a strategic adaptation of social engineering tactics.

3. What operational overlaps exist between UAC-0226 and other Ukrainian-targeting threat clusters such as UAC-0219 and UAC-0200, particularly regarding shared email infrastructure and malware delivery methods, and how can this knowledge be used to disrupt coordinated espionage efforts? CERT-UA and Arctic Wolf Labs have noted shared infrastructure and similar tactics among these groups, indicating potential multi-group coordination.

Forecast

Short-Term Forecast (3-6 months)

UAC-0226 will continue to escalate its cyber-espionage operations against Ukrainian military, law enforcement, and government institutions, focusing on exploiting geopolitical events such as ongoing conflict and peace negotiations. The GIFTEDCROOK malware is expected to receive targeted technical enhancements, including:

• Expanded file targeting to include additional sensitive document types (e.g., proprietary formats, configuration files like OpenVPN) and increased file size limits (up to 7 MB).
• Enhanced anti-analysis and evasion techniques, such as sleep evasion to bypass sandbox detection.
• Continued use of encrypted exfiltration channels via Telegram bot APIs, with potential addition of redundancy or alternative messaging platforms to evade network monitoring.
• More sophisticated social engineering lures themed around military mobilization, administrative fines, and conscription, timed to coincide with Ukrainian political and military developments.

Spear-phishing with macro-enabled Excel files and signed RDP files will remain the primary infection vectors, exploiting user trust and contextual urgency. The group may also refine its use of signed RDP files to establish stealthy remote access, facilitating lateral movement and persistence. Defensive efforts should prioritize advanced phishing detection, user training focused on macro and RDP risks, EDR tuning for anomalous RDP and Telegram traffic, and network segmentation to limit lateral movement.

Examples

• GIFTEDCROOK v1.3’s expanded file targeting (e.g., .docx, .pptx, .pdf, .ovpn) and sleep evasion techniques demonstrate the group’s rapid technical evolution.
• Use of Telegram bot channels for encrypted data exfiltration mirrors tactics employed by other espionage malware such as Zebrocy.
• Historical parallels with Russian APT groups increasing activity during geopolitical crises, e.g., APT28 during the 2014 Ukraine conflict.
• Overlapping email infrastructure with other Ukrainian-targeting clusters suggests a multi-pronged approach to espionage.

What to Watch Out For

• Emergence of new GIFTEDCROOK variants with expanded file targeting or new evasion techniques.
• Increased volume and sophistication of spear-phishing campaigns with macro-enabled Excel and signed RDP attachments referencing current Ukrainian military or administrative topics.
• Network telemetry indicating anomalous or increased Telegram API traffic or unusual RDP session activity.
• Signs of lateral movement within Ukrainian government or military networks facilitated by RDP access.

Long-Term Forecast (12-24 months)

UAC-0226 is likely to mature into a more persistent and technically sophisticated espionage actor, potentially integrating additional malware families or attack vectors such as supply chain compromises or zero-day exploits as defensive postures harden. While direct evidence of collaboration with other Ukrainian-targeting clusters (UAC-0219, UAC-0200) is not confirmed, shared infrastructure indicates potential operational overlaps that could evolve into coordinated campaigns. The group may expand targeting to Ukrainian allies or critical infrastructure sectors supporting Ukraine’s defense and governance.

Defensive strategies will need to evolve beyond reactive measures to include proactive threat hunting, AI-driven anomaly detection, and enhanced cross-agency intelligence sharing. Investments in network segmentation, strict access controls (RBAC, MFA), and tailored incident response plans will be essential to reduce dwell time and operational impact. The group’s continued adaptation to geopolitical events suggests espionage campaigns will remain aligned with strategic military and diplomatic timelines.

Examples

• Cozy Bear (APT29) evolved from targeted phishing to multi-vector campaigns including supply chain attacks, illustrating a plausible evolution path for UAC-0226.
• The shared email infrastructure among Ukrainian-targeting clusters suggests a potential for integrated or simultaneous campaigns to overwhelm defenses.
• The progression of GIFTEDCROOK from a simple stealer to a comprehensive intelligence platform parallels trends in advanced persistent threat actors globally.
• Historical espionage campaigns have expanded targeting to allied nations and critical infrastructure as geopolitical conflicts evolve.

What to Watch Out For

• Discovery of new malware tools or zero-day exploits linked to UAC-0226 or related clusters.
• Evidence of coordinated or simultaneous campaigns involving multiple threat groups targeting Ukraine or its allies.
• Increased targeting of critical infrastructure or supply chain partners supporting Ukrainian defense.
• Adoption of advanced evasion techniques such as fileless malware, living-off-the-land binaries, or AI-enhanced social engineering.

MITRE ATT&CK IDs

T1566 (Phishing), T1204 (User Execution), T1021.001 (Remote Desktop Protocol), T1059 (Command and Scripting Interpreter), T1041 (Exfiltration Over C2 Channel), TA0001 (Initial Access), TA0005 (Defense Evasion), TA0010 (Exfiltration), T1566.001 (Spearphishing Attachment), T1078 (Valid Accounts), T1562 (Impair Defenses), T1601 (Disk Wipe), S1050 (GIFTEDCROOK)

Appendix

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Have questions like this:

• giftedcrook?
• What are the specific Indicators of Compromise (IoCs) associated with GIFTEDCROOK infections?
• Are there any known overlaps or shared infrastructure between UAC-0226 and other threat groups targeting Ukraine?

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

References

1. (2025-06-26) - GIFTEDCROOK's Strategic Pivot: From Browser Stealer to Data Exfiltration Platform During Critical Ukraine Negotiations - Arctic Wolf Labs
2. (2025-04-08) - UAC-0226 Deploys GIFTEDCROOK Stealer via Malicious Excel Files Targeting Ukraine - The Hacker News
3. (2025-04-07) - CERT-UA Advisory on UAC-0226 Campaign Targeting Ukrainian Institutions (Referenced) (Note: Original advisory page currently returns 404 but is cited by multiple authoritative sources including The Hacker News and Arctic Wolf Labs)
4. (2025-04-07) - Hackers Are Using Macros and Telegram to Steal Data from Ukraine - Bitdefender
5. (2025) - UAC-0226 Cyber-Espionage Group Profile - Malpedia

MITRE ATTACK

Techniques

1. T1566 (Phishing) - UAC-0226 employs spear-phishing with macro-enabled Excel attachments and PDF lures themed around military mobilization and administrative topics to deliver GIFTEDCROOK malware. This is the primary initial access vector for their campaigns targeting Ukrainian military and government institutions.

   • Supported by CERT-UA and The Hacker News reporting on phishing emails with malicious Excel files used in April 2025 campaigns.
   • Phishing
   • Reference: The Hacker News - UAC-0226 Deploys GIFTEDCROOK Stealer via Malicious Excel Files

2. T1204 (User Execution) - The threat actor relies on user execution of malicious macros embedded in Excel files and opening of signed RDP files to establish footholds.

   • This technique is critical for malware deployment, exploiting user interaction with crafted documents.
   • Reference: Arctic Wolf Labs - GIFTEDCROOK's Strategic Pivot

3. T1021.001 (Remote Services: Remote Desktop Protocol) - UAC-0226 uses signed RDP files to establish stealthy remote access to compromised systems, facilitating lateral movement and persistence.

   • Reference: The Hacker News - UAC-0226 Deploys GIFTEDCROOK Stealer

4. T1059 (Command and Scripting Interpreter) - GIFTEDCROOK employs scripting for targeted file collection based on extensions and modification dates, as well as sleep evasion techniques.

   • Arctic Wolf Labs documents the malware’s evolution to include scripted intelligence-gathering capabilities.
   • Reference: Arctic Wolf Labs - GIFTEDCROOK's Strategic Pivot

5. T1041 (Exfiltration Over C2 Channel) - Data exfiltration via Telegram bot channels is a key technique used by UAC-0226 for stealthy and reliable data theft.

   • Broadcom and Arctic Wolf Labs confirm the use of Telegram API for exfiltration in mid-2025 campaigns.
   • Reference: Broadcom Protection Bulletin - GIFTEDCROOK Malware Upgraded for Document Theft via Telegram

Tactics

1. TA0001 (Initial Access) - Spear-phishing with malicious attachments is the initial access tactic used by UAC-0226 to compromise targets.

   • This tactic represents the entry point for espionage campaigns.
   • Reference: CERT-UA Advisory via The Hacker News

2. TA0005 (Defense Evasion) - Use of signed RDP files and sleep evasion techniques in GIFTEDCROOK malware exemplify defense evasion tactics.

   • These tactics help maintain stealth and persistence.
   • Reference: Arctic Wolf Labs

3. TA0010 (Exfiltration) - Data exfiltration via Telegram bot channels is a key tactic employed by UAC-0226.

   • This tactic is critical for the threat actor’s intelligence-gathering objectives.
   • Reference: Broadcom Protection Bulletin

Procedures

1. T1566.001 (Spearphishing Attachment) - Delivery of GIFTEDCROOK via spear-phishing emails containing macro-enabled Excel files.

   • Primary delivery mechanism documented by CERT-UA and The Hacker News.
   • Reference: The Hacker News

2. T1041 (Exfiltration Over C2 Channel) - Use of Telegram bot channels for exfiltration of stolen data.

   • Confirmed by Broadcom and Arctic Wolf Labs as a stealthy exfiltration method.
   • Reference: Broadcom Protection Bulletin

3. T1059 (Command and Scripting Interpreter) - Scripting used for targeted file collection and evasion techniques.

   • Arctic Wolf Labs details the malware’s scripted intelligence-gathering capabilities.
   • Reference: Arctic Wolf Labs

Software

1. S1050 (GIFTEDCROOK) - A multi-functional intelligence-gathering malware evolving from a browser data stealer to a comprehensive espionage platform.
   • Primary tool used by UAC-0226 for data theft and persistence.
   • Reference: The Hacker News, Arctic Wolf Labs

Mitigations

1. M1017 (User Training) - Training users to recognize and avoid phishing emails with malicious attachments reduces initial access risk.

   • Directly counters UAC-0226’s spear-phishing campaigns with macro-enabled Excel files.
   • Reference: The Hacker News

2. M1036 (Restrict Remote Desktop Protocol) - Limiting and monitoring RDP usage helps prevent unauthorized remote access.

   • Mitigates the use of signed RDP files by UAC-0226.
   • Reference: CERT-UA Advisory via The Hacker News

3. M1031 (Network Intrusion Prevention) - Deploying network monitoring to detect anomalous traffic such as Telegram API communications.

   • Helps detect exfiltration activities via Telegram bots.
   • Reference: Broadcom Protection Bulletin