Primary Compromise Vectors Used by UAC-0145 as of July 2026

Summary

The threat cluster UAC-0145, also known as Sandworm or APT44, relies on multiple initial compromise vectors, including torrent-distributed software installers and social engineering through Signal messenger. The operation uses custom malware families such as GHETTOVIBE and SCOUTCURL together with legitimate tools like OpenSSH and TOR to support lateral movement and port forwarding. It also employs a ClickFix-style technique with fake CAPTCHA prompts that trick users into running malicious PowerShell commands.

Investigation

CERT-UA investigated UAC-0145 and identified a shift from passive compromise through torrent-delivered software toward more direct social engineering on messaging platforms. The investigation uncovered the use of advanced web-based redirection through Cloaking.House and SMARTAXE, which relies on smart contracts for dynamic domain resolution. Analysis of compromised systems also revealed multiple loaders and backdoors aimed at both Windows and Android devices.

Mitigation

System administrators should monitor unauthorized use of OpenSSH and TOR for port forwarding and enforce strict controls around PowerShell execution. Organizations should train users to recognize ClickFix-style social engineering and avoid downloading software from untrusted torrent sources. Web administrators should also secure CMS platforms and monitor for unauthorized script changes or web shell activity.

Response

If this activity is detected, incident responders should isolate affected systems and investigate unauthorized network port forwarding, especially over ports 445, 3389, and 22. Forensic teams should scan for malware such as GHETTOVIBE and SCOUTCURL and review systems for unauthorized startup entries. Teams should also monitor for suspicious exfiltration activity involving rsync or Dropbox API usage.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has successfully delivered a malicious payload via a deceptive link (T1189). The payload executes and attempts to establish a heartbeat with its Command and Control (C2) server to receive further instructions. To bypass simple URL filters, the attacker uses infrastructure masquerading as legitimate Microsoft services. The payload will attempt to resolve and connect to office366.com. This action is intended to generate the specific dst.domain telemetry required to trigger the detection rule.

• Regression Test Script:

  # Simulation script to trigger the detection of malicious domain connections
  $maliciousDomains = @("office366.com", "365softupdate.com")
  
  foreach ($domain in $maliciousDomains) {
      Write-Host "Simulating connection attempt to: $domain" -ForegroundColor Yellow
      try {
          # We use Resolve-DnsName and Test-NetConnection to ensure 
          # both DNS and Network Connection telemetry are generated.
          $dns = Resolve-DnsName -Name $domain -ErrorAction SilentlyContinue
          if ($dns) {
              Test-NetConnection -ComputerName $domain -Port 80 -WarningAction SilentlyContinue
          } else {
              Write-Host "Domain $domain did not resolve, but attempting connection via IP/Direct simulation."
              # Fallback: simulating the network event logic even if DNS fails
              New-Object System.Net.Sockets.TcpClient("office366.com", 80) | Out-Null
          }
      } catch {
          Write-Host "Connection to $domain failed (expected if domain is sinkholed), but telemetry should have been generated." -ForegroundColor Cyan
      }
  }

• Cleanup Commands:

  # No permanent changes made to the system. 
  # Simply clear the simulation console history.
  Clear-Host