# UAC-0145 (Sandworm/APT44, GRU) Uses ClickFix Fake-CAPTCHA Lures and EtherHiding to Deploy Multi-Stage GHETTOVIBE/SCOUTCURL/FLUIDLEECH/FREAKYPOLL/COWARDDUCK Toolset Against Ukraine

> UAC-0145, a sub-cluster of the Russian GRU's Sandworm (APT44/Seashell Blizzard/UAC-0002 lineage), compromised at least 10 legitimate websites in June-July 2026 to serve fake CAPTCHA (ClickFix) prompts that trick Ukrainian government, military, and central-executive-authority users into pasting and executing malicious PowerShell into the Windows Run dialog. The intrusion chain deploys the GHETTOVIBE VBS persistence dropper, SCOUTCURL PowerShell reconnaissance tool, FLUIDLEECH and LOADLOOP loaders (FLUIDLEECH masquerades as antivirus-removal software), the FREAKYPOLL Python (.pyc) backdoor, and the COWARDDUCK Android backdoor, alongside legitimate-tool abuse (OpenSSH port forwarding, Tor, rsync, Dropbox API exfiltration). The SMARTAXE component dynamically rewrites compromised-site content and resolves attacker infrastructure via EtherHiding — reading payload/redirect domains from Ethereum/BNB Smart Chain smart contracts — while the Cloaking.House traffic-filtering service screens visitors to serve the malicious CAPTCHA overlay only to intended Ukrainian targets and hide it from crawlers, researchers, and non-target geographies.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1527
- **ID:** TL-2026-1527
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAC-0145 (Russia)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CERT-UA (advisory 6318437, published 2026-07-16) and CERT-UA-sourced reporting from The Record, The Hacker News, SOC Prime, The Cyber Express, and DKCERT describe a marked tactical shift by UAC-0145, a Sandworm/APT44 (GRU Unit 74455-lineage, also tracked as Seashell Blizzard and linked to the broader UAC-0002 cluster) sub-cluster, away from bespoke phishing lures and trojanized installers toward the ClickFix social-engineering technique. Beginning in spring 2026 and intensifying through June-July 2026, the group compromised more than ten legitimate websites and, via the Cloaking.House cloaking/traffic-filtering service, served fingerprinted Ukrainian visitors a fake browser CAPTCHA verification overlay. The overlay instructs the victim to press Win+R, paste a pre-loaded clipboard payload, and press Enter — executing an obfuscated PowerShell one-liner without any file ever touching disk at the point of execution.

The resulting intrusion chain deploys a modular toolset: GHETTOVIBE, a Visual Basic Script dropped into the Windows Startup directory for autorun persistence; SCOUTCURL, a PowerShell reconnaissance script that profiles the host (hardware/software inventory, installed security products, browser artifacts, local files) to triage victims before further staging; FLUIDLEECH, a loader that masquerades as antivirus-removal utility software to lower victim suspicion; and LOADLOOP, a secondary loader component. Later stages include FREAKYPOLL, a Python backdoor shipped as compiled .pyc bytecode, and — on Android, distributed via messaging apps (Signal) disguised as security/antivirus tooling — COWARDDUCK, a full-featured backdoor that harvests contacts, geolocation, and files matching sensitive extensions (.conf, .json, .ovpn, .txt, .doc, .docx, .xls, .xlsx, .pptx, .zip, .rar) from DCIM, Documents, Downloads, Pictures, and Alarms directories, exfiltrating via the Dropbox API.

The defining infrastructure innovation is SMARTAXE, a custom tool that dynamically alters compromised webpage content and resolves attacker-controlled redirect/payload domains by querying Ethereum and BNB Smart Chain smart contracts (a technique publicly dubbed EtherHiding by Google Threat Intelligence Group and previously observed in DPRK/UNC5342 Contagious Interview operations using the JADESNOW downloader). By embedding domain pointers in immutable, decentralized smart-contract storage, UAC-0145 removes any single attacker-controlled DNS or hosting resolver that defenders could seize or sinkhole — takedown would require contract-level blockchain intervention, which is not practically achievable. Observed UAC-0145 infrastructure includes the typosquatted Microsoft-lookalike domains office366[.]com and 365softupdate[.]com, plus abuse of legitimate services steamcommunity[.]com (C2 fallback/dead-drop resolver) and rsync/OpenSSH/Tor for lateral access and exfiltration staging. CERT-UA separately documented UAC-0145's parallel compromise vectors during the same window: torrent-distributed backdoored Windows/Office installers and Signal-based trust-building social engineering leading to bogus antivirus software execution — both feeding the same GHETTOVIBE/SCOUTCURL toolset. Related SOC Prime reporting also associates the wider UAC-0145/Sandworm cluster with KALAMBUR, SUMBUR, and TAMBUR post-access malware and prior Windows KMS-activator trojanization campaigns against Ukraine.

Targeting is concentrated on Ukrainian government networks, military personnel, and central executive authority systems, consistent with Sandworm's long-running (active since at least 2013) espionage and disruptive-access mission on behalf of Russian military intelligence. No CVE is associated with this campaign — the entire initial-access chain relies on social engineering (ClickFix) rather than software exploitation.

## MITRE ATT&CK

- T1584 Compromise Infrastructure
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1218 System Binary Proxy Execution
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1082 System Information Discovery
- T1518 Software Discovery
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1025 Data from Removable Media
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1102 Web Service
- T1090 Proxy
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1020 Automated Exfiltration
- T1021 Remote Services
- T1417 Input Capture
- T1517 Access Notifications

## Sources

- [UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware](https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html)
- [Sandworm hackers have a CAPTCHA trick for Ukrainians](https://therecord.media/ukraine-sandworm-hacks-captcha-powershell)
- [CERT-UA: Sandworm turns to ClickFix attacks](https://www.secnews.gr/en/722198/epithesis-clickfix-sandworm-cert-ua/)
- [ClickFix Attacks Fuel UAC-0145 Cyber Campaigns In Ukraine](https://thecyberexpress.com/clickfix-attacks-fuel-uac-0145-cyber-campaigns/)
- [UAC-0145 Uses Torrents, Signal, and ClickFix for Access](https://socprime.com/active-threats/primary-compromise-vectors-used-by-uac-0145-as-of-july-2026/)
- [Russian hackers use fake CAPTCHA to infect Ukrainian targets](https://www.scworld.com/brief/russian-hackers-use-fake-captcha-to-infect-ukrainian-targets)
- [Falske CAPTCHA-tjek bruges til at få brugere til at installere malware](https://cert.dk/news/2026-07-17/Falske-CAPTCHA-tjek-bruges-til-at-faa-brugere-til-at-installere-malware)
- [DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains](https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding)
- [Sandworm APT Attacks Detection: Russian State-Sponsored Hackers Deploy Malicious Windows KMS Activators to Target Ukraine](https://socprime.com/blog/detect-sandworm-apt-attacks-against-ukraine/)
- [Sandworm APT Targets Ukrainian Users with Trojanized Microsoft KMS Activation Tools in Cyber Espionage Campaigns](https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1527