UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via GitHub-Hosted Payloads and XSS Delivery
UAC-0252 SHADOWSNIFF & SALATSTEALER (TL-2026-0171), also tracked as CERT-UA#20032, is a high-severity advanced persistent threat campaign scored CVSS 8.8, first published 2026-03-02 and last reviewed 2026-08-24. It is attributed to UAC-0252 (Russia) with high confidence, affects Ukrainian Government Organizations Government and Military Personnel, references 1 CVE (CVE-2025-8088), maps to 29 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-0171
- Threat ID
- TL-2026-0171
- Also known as
- CERT-UA#20032
- Severity
- HIGH
- CVSS
- 8.8
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-03-02
- Last reviewed
- 2026-08-24
- Attribution
- UAC-0252
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- government, military, defense, public-administration
- Target regions
- Ukraine, Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-08-24 · revalidated 1× · latest source
Malware and tooling in UAC-0252 SHADOWSNIFF & SALATSTEALER
Malware and tooling: DEAFTICK, SHADOWSNIFF, SalatStealer, PowerShell
CERT-UA tracks UAC-0252 conducting stealer campaigns since January 2026, distributing SHADOWSNIFF, SALATSTEALER, and DEAFTICK malware via phishing emails impersonating Ukrainian central executive bodies and regional administrations. Payloads hosted on GitHub Pages exploit XSS vulnerabilities for delivery, targeting Ukrainian government and military personnel.
How UAC-0252 SHADOWSNIFF & SALATSTEALER works
CERT-UA advisory #20032 (published March 2, 2026) documents an ongoing campaign by threat cluster UAC-0252 active since January 2026. The campaign involves distribution of phishing emails impersonating Ukrainian central executive bodies (CEBs) and regional administrations, urging recipients to update mobile applications for widely-used civilian and military systems.
The attack chain leverages two delivery methods: (1) email attachments containing archives with malicious EXE files, and (2) links to legitimate but XSS-vulnerable websites that execute JavaScript code to download executables. Both the EXE payloads and scripts are hosted on GitHub resources, specifically GitHub Pages domains (mk-gov-ua.github.io, govermentnerc.github.io) that impersonate Ukrainian government entities.
Three malware families have been confirmed in use during January-February 2026:
1. SHADOWSNIFF — A credential stealer distributed as updateV3.23.exe, hosted on attacker-controlled domains (security.digital-ua.digital, ua-gov.info) that impersonate government update infrastructure. Multiple variants identified with different hashes.
2. SALATSTEALER — A Malware-as-a-Service (MaaS) credential stealer with extensive C2 infrastructure across multiple domains (salat.cn, salator.es, salator.ru, websalat.top, wrat.in) using the /sa1at/ URL path pattern. The name derives from the salat-themed domain naming convention.
3. DEAFTICK — A primitive backdoor written in Go, distributed as Diia_Update_4.7.1_Official.exe (impersonating the Ukrainian Diia government services app) and EdgeUpdate.exe (masquerading as Microsoft Edge updates). C2 communication occurs over HTTP to IPs on port 8888 and 8000 using the /client/addclient endpoint.
CERT-UA investigators also discovered a ransomware program named AVANGARD ULTIMATE v6.0 and a WinRAR exploit archive (CVE-2025-8088) in the attacker's GitHub repositories, indicating broader offensive capabilities beyond credential theft.
Persistence mechanisms include Windows Registry Run keys (WindowsUpdateService, MicrosoftEdgeUpdateTask), file hiding via attrib +h +s, and Windows Defender exclusion paths added via PowerShell. Payloads are typically copied to %TMP%\svchost.exe or %APPDATA%\Microsoft\Edge\Cache\.
CERT-UA links the activity to individuals associated with the Telegram channel PalachPro, suggesting a cybercriminal rather than state-sponsored motivation, though the targeting of Ukrainian government and military systems during active conflict elevates the operational significance.
MITRE ATT&CK techniques used in TL-2026-0171
collection
defense-evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories
Defense Evasion
T1027.002 Obfuscated Files or Information; T1036.004 Masquerading; T1055.001 Process Injection; T1562.001 Impair Defenses
exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery
Collection
T1113 Screen Capture; T1115 Clipboard Data
initial-access
T1189 Drive-by Compromise; T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Execution
T1203 Exploitation for Client Execution
credential-access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
persistence
T1547.001 Registry Run Keys / Startup Folder
resource-development
T1583.001 Domains; T1608.001 Upload Malware
defense-impairment
Affected products and versions in UAC-0252 SHADOWSNIFF & SALATSTEALER
- Ukrainian Government Organizations — Government and Military Personnel Endpoints
Vulnerable versions: Windows endpoints
Remediation for UAC-0252 SHADOWSNIFF & SALATSTEALER
Patches
- Patch XSS vulnerabilities on all public-facing websites to prevent drive-by delivery
- Update WinRAR to address CVE-2025-8088 exploit
Immediate actions
- Block all listed IOC domains and IPs at perimeter firewalls and DNS
- Search email gateways for phishing emails impersonating Ukrainian government bodies with software update lures
- Scan endpoints for listed file hashes using EDR or YARA rules
- Check Windows Registry Run keys for WindowsUpdateService and MicrosoftEdgeUpdateTask entries
- Inspect %TMP% and %APPDATA%\Microsoft\Edge\Cache\ for suspicious executables
- Review Windows Defender exclusion paths for unauthorized entries added via PowerShell
Workarounds
- Block execution of EXE files from archive attachments via email gateway policies
- Restrict PowerShell execution to prevent Defender exclusion manipulation
- Apply application whitelisting to prevent execution from %TMP% and %APPDATA% paths
Longer-term hardening
- Block GitHub Pages domains that impersonate government entities
- Implement XSS protections on all public-facing web properties
- Deploy behavioral detection for attrib +h +s combined with registry persistence
- Monitor for PowerShell Add-MpPreference -ExclusionPath commands
- Implement email authentication (SPF, DKIM, DMARC) to reduce government impersonation
- Deploy network monitoring for C2 patterns on non-standard ports (8888, 8000, 992)
CVEs associated with UAC-0252 SHADOWSNIFF & SALATSTEALER
Weaknesses (CWE) in UAC-0252 SHADOWSNIFF & SALATSTEALER
CWE-35
Timeline of UAC-0252 SHADOWSNIFF & SALATSTEALER
- RARLAB releases WinRAR 7.13, patching CVE-2025-8088, ahead of UAC-0252's later reuse of the flaw.
- CVE-2025-8088 (WinRAR path-traversal via NTFS alternate data streams) publicly disclosed; NVD assigns CVSS 3.1 8.8 HIGH.
- Independent reporting confirms the Russia-linked RomCom group exploited CVE-2025-8088 as a zero-day since late July 2025 to deploy SnipBot/RustyClaw/Mythic backdoors against European and Canadian targets.
- CERT-UA begins tracking UAC-0252 stealer campaign. First phishing emails observed impersonating Ukrainian central executive bodies with software update lures.
- GitHub Pages infrastructure (mk-gov-ua.github.io, govermentnerc.github.io) set up to host malicious payloads impersonating Ukrainian government domains.
- SHADOWSNIFF stealer variants (updateV3.23.exe) distributed via attacker-controlled domains digital-ua.digital and ua-gov.info.
- UAC-0252 observed reusing CVE-2025-8088 via a malicious WinRAR archive (1.rar) as an active delivery vector, not merely present in their GitHub repositories.
- SALATSTEALER MaaS stealer infrastructure activated across multiple salat-themed domains (salat.cn, salator.es, salator.ru, websalat.top, wrat.in).
- DEAFTICK Go backdoor distributed as Diia_Update_4.7.1_Official.exe (impersonating Ukrainian Diia government app) and EdgeUpdate.exe.
- CERT-UA investigators discover AVANGARD ULTIMATE v6.0 ransomware and CVE-2025-8088 WinRAR exploit in UAC-0252 GitHub repositories.
- CERT-UA publishes advisory #20032 documenting UAC-0252 campaign with full IOC list. Activity linked to PalachPro Telegram channel. Source: https://cert.gov.ua/article/6287707
- SOC Prime publishes detection-engineering analysis and Sigma content mapped to CERT-UA#20032 / UAC-0252 TTPs.
- As of 2026-05-29, UAC-0252/PalachPro remains active and undisrupted, with CERT-UA#20032 (Mar 2026) tracking the ongoing SHADOWSNIFF/SALATSTEALER/DEAFTICK credential-theft campaign against Ukrainian government/military and no takedown reported. The secondary CVE-2025-8088 (WinRAR) is in CISA KEV and patched, but Mandiant/Google confirm it is still actively exploited in 2026, so the threat stays ACTIVE.
Update history for TL-2026-0171
- 2026-08-24 — UAC-0252 Phishing Campaign Deploys SHADOWSNIFF and SALATSTEALER Stealers, DEAFTICK Backdoor (CERT-UA#20032): What changed CVSS score for CVE-2025-8088 confirmed at 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) where the existing record had it unset. The WinRAR exploit is now confirmed as an actual UAC-0252 delivery vector (a malicious 1.rar a
Sources cited for UAC-0252 SHADOWSNIFF & SALATSTEALER
- CERT-UA#20032 — UAC-0252 SHADOWSNIFF and SALATSTEALER Campaign
- GitHub Pages — mk-gov-ua.github.io (Attacker Infrastructure, Taken Down)
- GitHub Pages — govermentnerc.github.io (Attacker Infrastructure, Taken Down)
- MITRE ATT&CK — Phishing: Spearphishing Attachment
- MITRE ATT&CK — Phishing: Spearphishing Link
- NVD — CVE-2025-8088 WinRAR Path Traversal (CVSS 8.8)
- CISA KEV — CVE-2025-8088 WinRAR Path Traversal Exploited in Wild
- ESET Research — RomCom and Others Exploiting WinRAR CVE-2025-8088 Zero-Day
- Ars Technica — High-Severity WinRAR 0-Day Exploited by Two Groups
- CERT-UA Official — Ukrainian Computer Emergency Response Team
More in apt
- Nation-State and Financially Motivated Actors Weaponize Claude AI Multi-Agent Frameworks for Automated Cyberattacks and Data Theft
- Midnight Blizzard (GTG-20006) Used Claude AI Agents to Automate Malware Evasion, Hijack Hotel Wi-Fi (CaptiveCrunch), and Take Over WhatsApp Accounts Against Ukrainian/European Government and Drone-Supply-Chain Targets
- Iran Exploits SS7 Roaming Infrastructure and Commercial Ad-Tech to Track US Military Smartphones During Operation Epic Fury
- China-Based AI Companies Conducting Industrial-Scale Knowledge Distillation Campaigns Against U.S. Frontier AI Models
- China-Nexus and India-Nexus Espionage Groups Converge on Pakistani Law Enforcement Digitalization Platforms ("One Target, Two Flags")
Detection coverage for TL-2026-0171
As of 2026-08-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0171 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.