AgingFly Malware Campaign (UAC-0247) Targeting Ukrainian Governments, Hospitals, and Defense Personnel — Threadlinqs Intelligence
As of 2026-05-30, AgingFly Malware Campaign (UAC-0247) Targeting Ukrainian Governments, Hospitals, and Defense Personnel is a high-severity malware threat attributed to UAC-0247 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0389 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: UAC-0247 · Russia · ESPIONAGE
Ukraine's CERT-UA has attributed an active malware campaign tracked as UAC-0247 deploying a new C# toolset called AgingFly against Ukrainian local governments, hospitals, and members of the defense
On 2026-04-17, Ukraine's Computer Emergency Response Team (CERT-UA) published advisory 6288271 detailing an active cyberespionage campaign tracked as UAC-0247. The campaign relies on a previously undocumented modular implant named AgingFly — a C# malware family that is delivered in partially-assembled source form and compiled on the victim host after execution, sharply reducing the static signatures available for defenders and traditional antivirus engines.
Infection begins with targeted phishing emails impersonating humanitarian-aid offers, a lure explicitly tailored to Ukrainian recipients in wartime conditions. Victims are induced to download or open a malicious Windows shortcut (.lnk) file; when executed, the shortcut invokes PowerShell, which retrieves follow-on loader stages. The loaders stage AgingFly source/assemblies on disk, invoke the in-box C# compiler (csc.exe / Roslyn) to produce a working implant, and then launch it. This 'Compile After Delivery' (T1027.004) design is deliberately chosen to frustrate signature-based detection and allow per-victim polymorphism.
Once running, AgingFly provides remote operators with a full-featured remote access capability: arbitrary command execution, file theft, screen capture, keystroke logging, and on-demand delivery of additional payloads. Operators update configuration and rotate command-and-control endpoints through Telegram, using the messaging platform's public API infrastructure as a resilient covert channel (T1102 Web Service). PowerShell scripts are used in-band to refresh C2 routing and pull next-stage tooling.
The campaign layers well-known open-source offensive tooling on top of the custom implant. Chromium browser credentials and cookies are exfiltrated using ChromElevator (xaitax/Chrome-App-Bound-Encryption-Decryption), a public PoC that defeats Chrome's App-Bound Encryption to recover saved passwords and session cookies. WhatsApp desktop databases are dumped and decrypted using ZAPiXDESK (kraftdenker/ZAPiXDESK), giving operators access to victim chat history. Network reconnaissance is performed with RustScan (bee-san/RustScan), while Ligolo-ng and Chisel (jpillora/chisel) provide reverse tunnels and pivoting across segmented Ukrainian government networks.
CERT-UA reports the campaign has already impacted at least a dozen Ukrainian organizations — local government bodies and hospitals are explicitly named, and intelligence indicators suggest members of the Ukrainian defense forces have also been targeted. SentinelLabs, in its Week 16 roundup, corroborates the CERT-UA findings and publishes an attack-chain diagram. The combination of Ukrainian-government targeting, espionage-grade tradecraft, exfiltration of WhatsApp/browser secrets and defense-sector interest is consistent with the broader pattern of Russia-aligned intrusion sets active in Ukraine since 2022; however, CERT-UA has not (as of publication) issued a specific nation-state attribution beyond the UAC-0247 cluster label.
Defenders should treat this campaign as an active, high-severity threat: it produces few traditional IOCs (the implant is recompiled per host, C2 rides on a legitimate SaaS, and most of the post-exploitation toolset is open-source). Detection must focus on behavioral telemetry — .lnk → PowerShell chains, csc.exe / Roslyn compilation from unusual parent processes, Chrome DPAPI / App-Bound key extraction, WhatsApp sqlite/cryptkey reads, and outbound traffic to api.telegram.org from non-browser processes.
Weaknesses (CWE)
CWE-506, CWE-434, CWE-20, CWE-77
Target sectors: government, local-government, healthcare, hospitals, defense, military, public-sector
Target regions: Ukraine, Eastern Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.001, T1566.002, T1204, T1204.002, T1059, T1059.001, T1059.005, T1059.003, T1027