# UAC-0252 SHADOWSNIFF & SALATSTEALER — Credential Theft Campaign Impersonating Ukrainian Government via GitHub-Hosted Payloads and XSS Delivery

> CERT-UA tracks UAC-0252 conducting stealer campaigns since January 2026, distributing SHADOWSNIFF, SALATSTEALER, and DEAFTICK malware via phishing emails impersonating Ukrainian central executive bodies and regional administrations. Payloads hosted on GitHub Pages exploit XSS vulnerabilities for delivery, targeting Ukrainian government and military personnel.

- **Published:** 2026-03-02T22:47:00Z
- **Last reviewed:** 2026-08-24T13:53:22.623Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0171
- **ID:** TL-2026-0171
- **Severity:** HIGH (CVSS 8.8)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UAC-0252 (Russia)
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-8088

## Description

CERT-UA advisory #20032 (published March 2, 2026) documents an ongoing campaign by threat cluster UAC-0252 active since January 2026. The campaign involves distribution of phishing emails impersonating Ukrainian central executive bodies (CEBs) and regional administrations, urging recipients to update mobile applications for widely-used civilian and military systems.

The attack chain leverages two delivery methods: (1) email attachments containing archives with malicious EXE files, and (2) links to legitimate but XSS-vulnerable websites that execute JavaScript code to download executables. Both the EXE payloads and scripts are hosted on GitHub resources, specifically GitHub Pages domains (mk-gov-ua.github.io, govermentnerc.github.io) that impersonate Ukrainian government entities.

Three malware families have been confirmed in use during January-February 2026:

1. SHADOWSNIFF — A credential stealer distributed as updateV3.23.exe, hosted on attacker-controlled domains (security.digital-ua.digital, ua-gov.info) that impersonate government update infrastructure. Multiple variants identified with different hashes.

2. SALATSTEALER — A Malware-as-a-Service (MaaS) credential stealer with extensive C2 infrastructure across multiple domains (salat.cn, salator.es, salator.ru, websalat.top, wrat.in) using the /sa1at/ URL path pattern. The name derives from the salat-themed domain naming convention.

3. DEAFTICK — A primitive backdoor written in Go, distributed as Diia_Update_4.7.1_Official.exe (impersonating the Ukrainian Diia government services app) and EdgeUpdate.exe (masquerading as Microsoft Edge updates). C2 communication occurs over HTTP to IPs on port 8888 and 8000 using the /client/addclient endpoint.

CERT-UA investigators also discovered a ransomware program named AVANGARD ULTIMATE v6.0 and a WinRAR exploit archive (CVE-2025-8088) in the attacker's GitHub repositories, indicating broader offensive capabilities beyond credential theft.

Persistence mechanisms include Windows Registry Run keys (WindowsUpdateService, MicrosoftEdgeUpdateTask), file hiding via attrib +h +s, and Windows Defender exclusion paths added via PowerShell. Payloads are typically copied to %TMP%\svchost.exe or %APPDATA%\Microsoft\Edge\Cache\.

CERT-UA links the activity to individuals associated with the Telegram channel PalachPro, suggesting a cybercriminal rather than state-sponsored motivation, though the targeting of Ukrainian government and military systems during active conflict elevates the operational significance.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1608.001 Upload Malware
- T1583.001 Domains
- T1203 Exploitation for Client Execution
- T1053.005 Scheduled Task/Job
- T1036.004 Masquerading
- T1027.002 Obfuscated Files or Information
- T1055.001 Process Injection
- T1562.001 Impair Defenses
- T1082 System Information Discovery
- T1113 Screen Capture
- T1115 Clipboard Data

## Sources

- [CERT-UA#20032 — UAC-0252 SHADOWSNIFF and SALATSTEALER Campaign](https://cert.gov.ua/article/6287707)
- [GitHub Pages — mk-gov-ua.github.io (Attacker Infrastructure, Taken Down)](https://github.com/mk-gov-ua)
- [GitHub Pages — govermentnerc.github.io (Attacker Infrastructure, Taken Down)](https://github.com/govermentnerc)
- [MITRE ATT&CK — Phishing: Spearphishing Attachment](https://attack.mitre.org/techniques/T1566.001/)
- [MITRE ATT&CK — Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566.002/)
- [NVD — CVE-2025-8088 WinRAR Path Traversal (CVSS 8.8)](https://nvd.nist.gov/vuln/detail/CVE-2025-8088)
- [CISA KEV — CVE-2025-8088 WinRAR Path Traversal Exploited in Wild](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-8088)
- [ESET Research — RomCom and Others Exploiting WinRAR CVE-2025-8088 Zero-Day](https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/)
- [Ars Technica — High-Severity WinRAR 0-Day Exploited by Two Groups](https://arstechnica.com/security/2025/08/high-severity-winrar-0-day-exploited-for-weeks-by-2-groups/)
- [CERT-UA Official — Ukrainian Computer Emergency Response Team](https://cert.gov.ua/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0171