The Russia-aligned risk actor generally known as UAC-0184 has been noticed focusing on Ukrainian navy and authorities entities by leveraging the Viber messaging platform to ship malicious ZIP archives.
“This group has continued to conduct high-intensity intelligence gathering actions in opposition to Ukrainian navy and authorities departments in 2025,” the 360 Menace Intelligence Heart mentioned in a technical report.
Additionally tracked as Hive0156, the hacking group is primarily identified for leveraging war-themed lures in phishing emails to ship Hijack Loader in assaults focusing on Ukrainian entities. The malware loader subsequently acts as a pathway for Remcos RAT infections.
The risk actor was first documented by CERT-UA in early January 2024. Subsequent assault campaigns have been discovered to leverage messaging apps like Sign and Telegram as a supply car for malware. The newest findings from the Chinese language safety distributors level to an additional evolution of this tactic.
The assault chain includes the usage of Viber as an preliminary intrusion vector to distribute malicious ZIP archives containing a number of Home windows shortcut (LNK) information disguised as official Microsoft Phrase and Excel paperwork to trick recipients into opening them.
The LNK information are designed to function a decoy doc to the sufferer to decrease their suspicion, whereas silently executing Hijack Loader within the background by fetching a second ZIP archive (“smoothieks.zip”) from a distant server by the use of a PowerShell script.
The assault reconstructs and deploys Hijack Loader in reminiscence by way of a multi-stage course of that employs methods like DLL side-loading and module stomping to evade detection by safety instruments. The loader then scans the atmosphere for put in safety software program, reminiscent of these associated to Kaspersky, Avast, BitDefender, AVG, Emsisoft, Webroot, and Microsoft, by calculating the CRC32 hash of the corresponding program.
Apart from establishing persistence by the use of scheduled duties, the loader takes steps to subvert static signature detection earlier than covertly executing Remcos RAT by injecting it into “chime.exe.” The distant administration software grants the attackers the power to handle the endpoint, execute payloads, monitor actions, and steal knowledge.
“Though marketed as official system administration software program, its highly effective intrusive capabilities make it continuously utilized by numerous malicious attackers for cyber espionage and knowledge theft actions,” the 360 Menace Intelligence Heart mentioned. “By the graphical consumer interface (GUI) management panel offered by Remcos, attackers can carry out batch automated administration or exact guide interactive operations on the sufferer’s host.”
