UAC-0099 Deploys ASHVEIN RAT via HTML Command Hiding Against Ukrainian Government Targets

The campaign used spear-phished HTML attachments that rendered innocuous while executing JavaScript to fetch and decrypt the RAT payload. Contract and procurement records show UAC-0099 has repeatedly targeted Ukrainian defense-adjacent ministries since 2024, with consistent use of HTML steganography to evade sandbox detection. Incident reports from affected hosts confirm the RAT established WebSocket channels to infrastructure previously linked to the same actor via Solana dead-drop patterns.

Morphisec telemetry on similar multi-stage loaders and Group-IB analysis of Python-based C2 frameworks reveal overlapping TTPs, including signed drivers for process termination and task scheduler injection. Official Ukrainian statements attribute the activity to Russian state actors, yet no independent packet captures or code signing artifacts have been released to confirm that link.

The pattern indicates UAC-0099 is refining HTML-based command channels to maintain access inside air-gapped or heavily monitored environments. Next expected development is expansion of the same technique into VS Code extension supply chains already observed in related clusters.