AgingFly Malware — UAC-0247 Targets Ukrainian Government Agencies and Hospitals with Novel Dynamic C2 RAT — Threadlinqs Intelligence
As of 2026-05-30, AgingFly Malware — UAC-0247 Targets Ukrainian Government Agencies and Hospitals with Novel Dynamic C2 RAT is a high-severity malware threat attributed to UAC-0247 (Russia (suspected)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-0372 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: UAC-0247 · Russia (suspected) · ESPIONAGE
CERT-UA tracks threat actor UAC-0247 deploying the novel AgingFly C# remote access trojan against Ukrainian local government agencies, hospitals, and Defense Forces representatives. The malware
In April 2026, CERT-UA published advisory #6288271 detailing a sustained cyber-espionage campaign by threat actor UAC-0247 targeting Ukrainian local government agencies, hospitals, and Defense Forces representatives. The campaign, active since at least March 2026 with over a dozen investigated incidents, employs a novel malware family designated AgingFly — a C# remote access trojan with a distinctive architecture that retrieves command handlers as source code from the C2 server and compiles them dynamically at runtime.
The infection chain begins with spearphishing emails crafted around humanitarian aid themes. Embedded links direct victims to either compromised legitimate websites (exploited via cross-site scripting vulnerabilities) or AI-generated fake humanitarian aid sites. The landing page serves an archive containing a malicious LNK shortcut file. When executed, the LNK triggers an HTA (HTML Application) handler that retrieves and executes an HTA file from a remote resource. The HTA displays a decoy humanitarian aid form to the victim while silently creating a scheduled task for persistence.
The loader chain proceeds through multiple stages: a first-stage executable downloads and injects shellcode into a legitimate system process via process hollowing. The second stage employs a custom executable format with a compressed and encrypted final payload. A TCP reverse shell component designated RAVENSHELL — using XOR cipher encryption — establishes initial communication with a management server. The SILENTLOOP component, implemented as a PowerShell script, provides additional command execution capability and retrieves C2 configuration data via Telegram channels or fallback mechanisms.
AgingFly itself represents a significant evolution in RAT architecture. Unlike conventional trojans that ship with a fixed set of command handlers, AgingFly contains no built-in command handling logic. Instead, it establishes a WebSocket connection to its C2 server encrypted with AES-CBC using static keys, then receives C# source code for command handlers on demand. These handlers are compiled at runtime using the .NET CodeDomProvider/CSharpCodeProvider API, loaded into the running process, and executed. This design gives operators maximum flexibility to deploy new capabilities without updating the implant binary, while also complicating static analysis since the malware binary alone reveals no specific capabilities.
Post-exploitation activity observed in UAC-0247 operations leverages a toolkit of open-source offensive tools. ChromElevator is deployed for browser credential theft — it uses syscall-based process hollowing to inject into Chromium-based browser processes (Chrome, Edge, Brave), bypassing Application-Bound Encryption protections to extract saved passwords, cookies, and encryption keys from the Login Data and Cookies SQLite databases. ZAPiDESK, an open-source forensic utility, is repurposed for decrypting WhatsApp Windows desktop databases, enabling access to victims messaging data. Network reconnaissance is conducted with RustScan, a fast Rust-based port scanner, while lateral movement through compromised networks is facilitated by Ligolo-ng and Chisel tunneling proxies that establish reverse tunnels through network boundaries.
The targeting of Ukrainian healthcare infrastructure alongside government and military entities reflects an escalation in the Russia-Ukraine cyber conflict, with civilian critical infrastructure directly in scope. The dynamic compilation technique employed by AgingFly represents an evolution that challenges traditional signature-based detection, requiring defenders to focus on behavioral indicators such as runtime compilation events, WebSocket C2 patterns, and the characteristic tool deployment chain.
Target sectors: government, healthcare, military, defense, public-sector
Target regions: Ukraine, Eastern Europe
Detections & IOCs
As of 2026-08-10, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1598, T1584, T1587, T1608, T1566, T1059, T1204, T1106, T1053, T1055
