UAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Personnel, Hiding Commands in HTML
What Happened – The Russia‑aligned threat actor UAC‑0099 has been linked to a previously undocumented .NET infostealer and remote‑access trojan (RAT) called ASHVEIN. TrendAI reports that the malware is being used in campaigns targeting Ukrainian government personnel, with its command‑and‑control instructions concealed inside seemingly benign HTML files to evade detection.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of privileged access and command execution is required to spot hidden malicious activity such as HTML‑embedded RAT commands.
- Robust endpoint detection and evidence‑collection practices provide a defensible audit trail for any unauthorized remote‑access attempts.
- Demonstrating effective access‑control assurance helps satisfy multiple framework objectives (e.g., NIST CSF 2.0 “Protect” function) with a single control evidence set.
Who Is Affected – Ukrainian government agencies and any organizations that share personnel or supply‑chain relationships with them.
Recommended Actions
- Deploy application‑whitelisting and integrity‑verification for HTML and other web assets.
- Strengthen endpoint detection and response (EDR) to flag anomalous .NET processes and hidden command strings.
- Review and tighten privileged‑access policies for government staff, ensuring least‑privilege and MFA where possible.
Source: The Hacker News
Technical Notes – ASHVEIN is a .NET‑based infostealer/RAT that hides its command payloads inside HTML tags, making network‑based signatures less effective. The campaign appears to rely on spear‑phishing or compromised web resources to deliver the payload.
Source: The Hacker News