APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & EU (2024-2026 New TTPs)

APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & (TL-2026-0066) is a high-severity advanced persistent threat campaign, first published 2026-02-12. It is attributed to APT28 (Russia) with high confidence, references 8 CVEs (CVE-2024-11182, CVE-2023-43770, CVE-2024-27443), maps to 49 MITRE ATT&CK techniques (T1005, T1016, T1021), and is covered by 9 detection rules and 46 indicators of compromise.

Key facts for TL-2026-0066

Threat ID
TL-2026-0066
Severity
HIGH
Status
ACTIVE
Category
APT
First published
2026-02-12
Last reviewed
2026-02-12
Attribution
APT28
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
Government, Military, Defense Industry, Logistics/Transportation, IT Services, Maritime, Air Traffic Management, Energy, Diplomatic, Education
Target regions
Ukraine, EU (Bulgaria, Romania, France, Germany, Greece, Italy, Netherlands, Poland, Czech Republic, Slovakia, Cyprus, Serbia), United States, Moldova, Ecuador, Cameroon, Central Asia (Kazakhstan, Tajikistan)
Detection rules
9
Indicators of compromise
46

Malware and tooling in APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

Malware and tooling: Headlace, LAMEHUG, MASEPIE, OCEANMAP, STEELHOOK, SpyPress, Covenant

APT28 (Fancy Bear / UAC-0001 / Forest Blizzard / BlueDelta / GRU Unit 26165) has executed a sustained, multi-vector cyber espionage campaign against Ukraine and EU member states throughout 2024-2026, deploying at least 6 distinct malware families, exploiting zero-day vulnerabilities, pioneering the first known LLM-powered malware (LAMEHUG), targeting western logistics and defense supply chains via a 21-nation joint advisory, compromising webmail servers across 4 platforms (Roundcube, Horde, MDaemon, Zimbra) via Operation RoundPress, and weaponizing Signal Desktop as a spearphishing vector in Operation Phantom Net Voxel. Key innovations: (1) LAMEHUG uses Qwen2.5-Coder-32B-Instruct via Hugging Face API for real-time command generation — the first documented state-sponsored LLM integration in malware; (2) Signal Desktop exploitation bypasses MOTW (Mark of the Web) protections because Signal does not apply MOTW to received files, allowing VBA macros to execute without Microsoft Office security blocks; (3) SpyPress.MDAEMON exploited a zero-day XSS (CVE-2024-11182) to bypass 2FA in webmail; (4) BEARDSHELL uses IceDrive cloud storage for C2, GONEPOSTAL provides Outlook backdoor access, and Covenant/Grunt framework leverages Koofr cloud API for staging — all using legitimate cloud services to evade detection. The campaign demonstrates GRU's systematic targeting of Ukraine's security/defense sector, EU logistics networks supporting Ukraine aid, and NATO defense companies — with Ukraine serving as a live testing ground for capabilities later deployed against Western targets.

How APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine & works

APT28/UAC-0001 Sustained Cyber Espionage Campaign Against Ukraine and EU (2024-2026 New TTPs)

Attribution: GRU 85th Main Special Service Center (GTsSS), Military Unit 26165. Tracked as APT28, Fancy Bear, Forest Blizzard, BlueDelta, Sednit, Sofacy, Pawn Storm, STRONTIUM, ITG05, UAC-0001, UAC-0028, and 20+ other aliases.

This threat consolidates the significant escalation in APT28's capabilities and targeting during the 2024-2026 period, focusing on newly documented TTPs that represent evolution beyond previously tracked activity (see TL-2026-0052 for earlier APT28 operations).

=== CAMPAIGN 1: OPERATION PHANTOM NET VOXEL (Sekoia, Sep 2025) ===

Infection Vector: Signal Desktop spearphishing — a first for APT28. Signal Desktop does NOT implement Mark of the Web (MOTW), meaning files received via Signal do not get tagged with the ADS zone identifier. This allows VBA macros in received Office documents to execute without Microsoft Office's MOTW-based security blocks (which would normally prevent macro execution for internet-downloaded files).

Social Engineering: Messages sent via private Signal chats, impersonating colleagues/superiors, invoking compensation decisions and threatening legal action to create urgency. Targets: Ukrainian military administrative staff — brigade-level HR, logistics, command structures.

Lure Documents: Ukrainian military administrative forms — personnel evaluations, medical compensation requests, drone delivery receipts, military permission forms. At least 11 weaponized Office documents identified. Documents designed to appear credible to on-the-ground military personnel under martial law.

Infection Chain: 1. VBA macros in Office document execute on open (no MOTW block via Signal) 2. Macros verify Windows OS and .NET Framework v4.0.30319 3. COM hijack persistence: registers malicious prnfldr.dll at HKCU\Software\Classes\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\InProcServer32 — the Printers CLSID, loaded by explorer.exe at every logon 4. Steganography: windows.png (valid Windows background image) contains AES-CBC encrypted shellcode hidden in LSB of each pixel's RGBA values (4 bytes per pixel, LSB extraction) 5. Shellcode loads .NET Covenant/Grunt framework — GruntHTTPStager establishes API-driven channel to Koofr cloud storage 6. Downloads PlaySndSrv.dll + sample-03.wav → extracts BEARDSHELL C++ backdoor 7. BEARDSHELL uses IceDrive cloud storage for C2 — receives and executes PowerShell commands 8. SlimAgent spyware also observed on same compromised servers

Key Innovation: Signal Desktop MOTW bypass is the critical enabler. Microsoft's macro blocking policies (implemented 2022) are completely circumvented because Signal doesn't mark received files as internet-sourced.

=== CAMPAIGN 2: LAMEHUG — First LLM-Powered Malware (CERT-UA, Jul 2025) ===

Discovery: July 10, 2025, by CERT-UA. Published July 17, 2025. Attribution: APT28 with moderate confidence.

Target: Ukrainian government officials.

Attack Vector: Phishing emails impersonating Ukrainian ministry officials, containing ZIP archives with PyInstaller-compiled Python executables (.pif extension).

LLM Integration: LAMEHUG uses Qwen2.5-Coder-32B-Instruct model via Hugging Face API (approximately 270 tokens for authentication) to generate commands in real-time:

Prompt 1 (System Reconnaissance): 'Make a list of commands to create folder C:\Programdata\info and to gather computer information, hardware information, process and services information, networks information, AD domain information, to execute in one line and add each result to text file c:\Programdata\info\info.txt. Return only commands, without markdown.'

Prompt 2 (Document Harvesting): 'Make a list of commands to copy recursively different office and pdf/txt documents in user Documents, Downloads and Desktop folders to a folder c:\Programdata\info\ to execute in one line. Return only command, without markdown.'

The LLM generates comprehensive reconnaissance commands including: systeminfo, wmic (hardware/CPU/memory/disk/NIC), tasklist, net start, ipconfig /all, whoami, dsquery (full AD enumeration).

Variants: - Додаток.pif (Attachment.pif) — save_document.py: HTTP POST exfiltration to stayathomeclasses[.]com/slpw/up.php - AI_generator_uncensored_Canvas_PRO_v0.9.exe / AI_image_generator_v0.95.exe — image.py: Uses Flux AI image generator as lure while SFTP exfiltration to 144[.]126[.]202[.]227

Why This Matters: First documented integration of LLM capabilities in state-sponsored malware. Dynamic command generation defeats signature-based detection. Commands are generated at runtime, never the same twice. Assessed as PoC testing — relatively simple Python, straightforward LLM integration, limited OPSEC — suggesting APT28 is learning to weaponize LLMs for future sophisticated operations.

=== CAMPAIGN 3: OPERATION ROUNDPRESS — Webmail XSS Exploitation (ESET, 2024) ===

Targets: Governmental entities and defense companies in Eastern Europe (Ukraine, Bulgaria, Romania, Serbia, Greece, Cyprus), plus Africa (Cameroon) and South America (Ecuador). Defense companies producing Soviet-era weapons for Ukraine specifically targeted.

Attack: XSS vulnerabilities in 4 webmail platforms: - Roundcube: CVE-2023-43770 (known) - MDaemon: CVE-2024-11182 (zero-day, reported by ESET Nov 1 2024, patched Nov 14 2024) - Horde: Unknown old XSS vulnerability - Zimbra: CVE-2024-27443

Payloads — SpyPress family: - SpyPress.ROUNDCUBE: Steals webmail credentials, exfiltrates contacts and email messages - SpyPress.MDAEMON: Same + bypasses two-factor authentication (2FA) - SpyPress.HORDE: Credential and email theft - SpyPress.ZIMBRA: Credential and email theft

Delivery: Spearphishing emails with news-themed lures (Ukrainian SBU arrests, Putin-Trump relations) containing hidden XSS exploits in HTML body.

=== CAMPAIGN 4: WESTERN LOGISTICS TARGETING (CISA Joint Advisory AA25-141A, May 2025) ===

21-nation joint advisory (NSA, FBI, NCSC-UK, BND, BSI, BfV, Czech VZ/NUKIB/BIS, Polish ABW/SKW, CISA, DC3, USCYBERCOM, ASD ACSC, CCCS, Danish DDIS, Estonian EFIS/NCSC-EE, French ANSSI, Dutch MIVD).

Targeting: Western logistics entities and technology companies involved in Ukraine aid coordination, transport, and delivery. Targeted sectors: Defense Industry, Transportation/Hubs, Maritime, Air Traffic Management, IT Services. Countries: Bulgaria, Czech Republic, France, Germany, Greece, Italy, Moldova, Netherlands, Poland, Romania, Slovakia, Ukraine, United States.

TTPs: Credential guessing/brute force via Tor/commercial VPNs with IP rotation, spearphishing with fake login pages, Outlook NTLM exploitation (CVE-2023-23397), Roundcube vulnerabilities, WinRAR CVE-2023-38831, VPN exploitation, SQL injection. Malware: HEADLACE, MASEPIE, STEELHOOK, OCEANMAP, Mocky LNK.

IP Camera Targeting: Monitoring internet-connected cameras at Ukrainian border crossings and NATO-adjacent areas to track aid shipments — intelligence collection on military logistics.

=== CAMPAIGN 5: GONEPOSTAL — Outlook Backdoor (Kroll, Sep 2025) ===

GONEPOSTAL provides backdoor access to Microsoft Outlook, enabling persistent email access and data exfiltration. Analyzed by Kroll researchers. Connected to APT28's broader espionage toolkit.

=== CAMPAIGN 6: CERT-FR ANSSI Report (Apr 2025) ===

French ANSSI documented APT28 targeting and compromising French entities using STEELHOOK, MASEPIE, Mocky LNK, and OCEANMAP. Confirmed GRU Unit 26165 attribution.

MITRE ATT&CK techniques used in TL-2026-0066

collection

T1005 Data from Local System; T1056 Input Capture; T1074 Data Staged; T1114 Email Collection; T1119 Automated Collection; T1125 Video Capture

discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion

exfiltration

T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

persistence

T1098 Account Manipulation; T1133 External Remote Services; T1137 Office Application Startup; T1547 Boot or Logon Autostart Execution; T1574 Hijack Execution Flow

credential-access

T1110 Brute Force; T1111 Multi-Factor Authentication Interception; T1187 Forced Authentication; T1539 Steal Web Session Cookie

initial-access

T1190 Exploit Public-Facing Application; T1199 Trusted Relationship; T1566 Phishing

privilege-escalation

T1546 Event Triggered Execution

defense-impairment

T1553 Subvert Trust Controls

resource-development

T1586 Compromise Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities

reconnaissance

T1589 Gather Victim Identity Information; T1591 Gather Victim Org Information

Remediation for APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

Patches

  • MDaemon 24.5.1 — CVE-2024-11182 zero-day XSS (ESET-reported, patched Nov 14 2024)
  • Roundcube 1.6.3+ — CVE-2023-43770 XSS (patched Sep 14 2023)
  • Zimbra — CVE-2024-27443 XSS patch
  • Microsoft Outlook — CVE-2023-23397 NTLM vulnerability patch
  • WinRAR — CVE-2023-38831 patch

Immediate actions

  • Block or restrict VBA macro execution in Office documents received via Signal Desktop — Signal does not apply MOTW, allowing macros to bypass Microsoft's security blocks
  • Patch MDaemon Email Server to 24.5.1+ (CVE-2024-11182), Roundcube to 1.6.3+ (CVE-2023-43770), and Zimbra for CVE-2024-27443 immediately
  • Monitor for connections to Hugging Face API (router.huggingface.co) from non-development endpoints — LAMEHUG uses this for LLM-driven command generation
  • Review Exchange mailbox permissions for unauthorized delegate access — APT28 modifies mailbox permissions for persistent email access
  • Deploy IOC-based detection for known C2 infrastructure: 144.126.202.227, stayathomeclasses.com, and Koofr/IceDrive cloud API connections from non-standard processes

Workarounds

  • Disable VBA macros entirely in enterprise environments — APT28's primary initial access via Operation Phantom Net Voxel relies on macro execution
  • Block outbound connections to IRC, SFTP, and non-standard cloud storage APIs from workstation and server VLANs
  • Implement geo-fencing on email infrastructure — block or alert on authentication from unexpected countries
  • Deploy decoy documents and canary tokens in military/logistics document workflows to detect spearphishing document access

Longer-term hardening

  • Implement application control policies that block Office macro execution regardless of MOTW status — defense-in-depth against Signal/messaging app delivery
  • Deploy outbound API monitoring: alert on connections from workstations to LLM inference APIs (Hugging Face, OpenAI, etc.) from non-browser processes
  • Segment and monitor cloud storage API access (Koofr, IceDrive, OneDrive) — APT28 uses legitimate cloud services for C2 staging and exfiltration
  • Enforce hardware-based MFA for webmail and email systems — SpyPress.MDAEMON bypasses software-based 2FA
  • Implement strict email security: DMARC enforcement, link sandboxing, and HTML rendering restrictions to prevent XSS exploitation in webmail
  • Deploy network monitoring for IP camera access patterns — APT28 monitors border crossing cameras for logistics intelligence
  • Conduct regular security assessments of all internet-facing webmail servers — XSS vulnerabilities in any webmail platform are actively exploited

CVEs associated with APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

CVE-2024-11182, CVE-2023-43770, CVE-2024-27443, CVE-2023-23397, CVE-2023-38831, CVE-2020-35730, CVE-2020-12641, CVE-2021-44026

Weaknesses (CWE) in APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

CWE-79, CWE-94, CWE-434, CWE-287, CWE-200, CWE-532

Timeline of APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

  • APT28/Fancy Bear begins operations, believed tied to Russian GRU. Initially focused on government, military, and security organizations. Would grow to become one of the most prolific state-sponsored cyber espionage groups with 28+ tracked aliases across the intelligence community.
  • ESET detects Operation RoundPress expanding from Roundcube-only (2023) to targeting Horde, MDaemon, Zimbra, and updated Roundcube vulnerabilities. Targets include Ukrainian military, Bulgarian/Romanian defense companies producing Soviet-era weapons for Ukraine, plus governments in Greece, Serbia, Cyprus, Cameroon, Ecuador. SpyPress malware family deployed across all 4 platforms.
  • ESET discovers APT28 exploiting zero-day XSS in MDaemon Email Server (CVE-2024-11182) against Ukrainian state-owned defense companies and civil air transport. Reported to MDaemon same day. SpyPress.MDAEMON capable of bypassing two-factor authentication. Source: ESET Operation RoundPress report.
  • MDaemon version 24.5.1 released, patching CVE-2024-11182 zero-day XSS. 13 days from ESET disclosure to patch — rapid vendor response for a zero-day exploited by a nation-state actor.
  • Volexity publishes 'The Nearest Neighbor Attack' — APT28 weaponized nearby Wi-Fi networks for covert access, demonstrating innovative proximity-based attack techniques. Source: Volexity.
  • Trend Micro documents APT28 (Pawn Storm) using brute force and stealth against high-value targets, including Mocky LNK malware and information stealers. Source: Trend Micro.
  • French ANSSI (CERT-FR) publishes report documenting APT28 targeting and compromising French entities using STEELHOOK, MASEPIE, Mocky LNK, and OCEANMAP. Confirms GRU Unit 26165 attribution. Source: CERTFR-2025-CTI-007.
  • ESET publishes comprehensive Operation RoundPress report: APT28 exploiting XSS vulnerabilities across 4 webmail platforms (Roundcube, Horde, MDaemon, Zimbra). Documents SpyPress malware family with 2FA bypass capability. MDaemon zero-day (CVE-2024-11182) disclosed. Medium-confidence Sednit attribution. Source: ESET WeLiveSecurity.
  • 21-nation joint advisory (CISA AA25-141A) published: Russian GRU Unit 26165 targeting Western logistics entities and technology companies involved in Ukraine aid delivery. Targeting across 13 countries. TTPs include brute force, spearphishing, Outlook NTLM exploitation, Roundcube vulnerabilities, WinRAR exploitation, VPN compromise. IP camera surveillance at Ukrainian border crossings. Source: NSA/FBI/NCSC-UK/BND/BSI + 16 partner agencies.
  • CERT-UA publishes report on UAC-0001 (APT28) cyberattacks against public authorities using BEARDSHELL and COVENANT. Signal Desktop used as delivery vector — first documented APT28 use of Signal for spearphishing. Documents COM hijack persistence via Printers CLSID, steganography in PNG files, and cloud-based C2 via IceDrive. Source: CERT-UA.
  • CERT-UA discovers LAMEHUG malware targeting Ukrainian government officials. First documented malware integrating LLM capabilities (Qwen2.5-Coder-32B-Instruct via Hugging Face API) for real-time command generation. Multiple variants with different exfiltration methods (HTTP POST and SFTP). Source: CERT-UA.
  • CERT-UA publicly reports LAMEHUG (CERT-UA#16039). Attribution to APT28 with moderate confidence. Documents PyInstaller-compiled Python executables, LLM-generated reconnaissance commands, and Hugging Face API abuse. Source: CERT-UA.
  • Cato Networks CTRL publishes deep technical analysis of LAMEHUG. Reveals exact prompts (base64-encoded), documents system reconnaissance and document harvesting capabilities, identifies approximately 270 Hugging Face tokens used, analyzes SFTP and HTTP exfiltration variants. Assesses as PoC testing of LLM weaponization. Source: Cato Networks.
  • Lab52 publishes analysis of NotDoor/GONEPOSTAL — APT28's Outlook backdoor providing persistent email access. Similarity to Cordyceps noted. Expanding APT28 arsenal for email-targeted espionage. Source: Lab52.
  • Kroll publishes 'FANCY BEAR GONEPOSTAL' — detailed analysis of the Outlook backdoor espionage tool. Confirms APT28 attribution. GONEPOSTAL provides persistent backdoor access to Microsoft Outlook for email surveillance and data exfiltration. Source: Kroll.
  • Sekoia TDR publishes Operation Phantom Net Voxel report. Reveals Signal Desktop MOTW bypass, full infection chain analysis: VBA macros → COM hijack (Printers CLSID) → steganography (LSB in PNG) → Covenant/Grunt via Koofr → BEARDSHELL via IceDrive → SlimAgent. 11 weaponized Office documents targeting Ukrainian military administrative staff. Source: Sekoia.
  • Threadlinqs consolidates APT28 2024-2026 campaign analysis. 6 distinct campaigns, 10+ malware families, 8 CVEs, zero-day exploitation, first LLM-powered malware, 21-nation joint advisory, Signal Desktop weaponization, webmail XSS across 4 platforms. This represents the most intensive documented period of APT28 operations, with Ukraine as primary target and Western logistics/defense as expanding scope.
  • As of 2026-05-29, this APT28/GRU Unit 26165 espionage program remains ACTIVE: the actor weaponized CVE-2026-21509 within 24h (Trellix), kept exploiting Roundcube against Ukraine's anti-corruption agencies (The Record, Apr 2026), and ran FrostArmada SOHO-router DNS hijacking peaking at 18,000+ IPs (Lumen). DOJ/FBI Operation Masquerade (Apr 2026) and UK sanctions disrupted only the U.S. router segment, not the actor.

Sources cited for APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

Threats related to APT28/UAC-0001 Sustained Cyber Espionage Against Ukraine &

Detection coverage for TL-2026-0066

As of 2026-02-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0066 across Splunk SPL, Microsoft KQL and Sigma, covering 46 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats