Cyberattack UAC-0255 disguised as a notification from CERT-UA using the AGEWHEEZE tool

Summary

A phishing campaign masquerading as CERT-UA delivered password-protected archives containing the AGEWHEEZE remote access tool. Written in Go, the malware enables full remote control of infected systems, including screen capture, input emulation, file operations, and persistence. Command-and-control traffic is carried over WebSockets to an OVH-hosted server listening on port 8443. Targeted victims included Ukrainian government agencies, healthcare institutions, financial organizations, and educational entities.

Investigation

CERT-UA researchers gathered the phishing emails, the fraudulent website cert-ua.tech, and the malicious binaries for analysis. Static review uncovered RAT-related file paths, scheduled tasks, and registry autorun entries used for persistence. Network analysis identified the C2 server on OVH using a self-signed certificate and a WebSocket listener at 54.36.237.92:8443. The activity was tracked under incident UAC-0255.

Mitigation

Organizations should block messages from unknown senders impersonating CERT-UA, prevent execution of files launched from %APPDATA% locations, and monitor for the described scheduled tasks and registry Run keys. Network controls should deny outbound connections to the identified C2 IP and related domains. Least-privilege access policies and up-to-date AV signatures should also be enforced.

Response

Defenders should detect AGEWHEEZE binaries, the scheduled tasks SvcHelper and CoreService, and the related registry Run entries. Affected systems must be isolated, volatile evidence collected, and full malware analysis performed. Relevant national CERTs should be notified, and detection content should be updated with all extracted IOCs.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (T1059) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An adversary who has already compromised a user’s session wants to establish persistence by installing the AGEWHEEZE RAT. They copy the RAT binary into the user’s %APPDATA%SysSvc directory (a known “installation” folder) and then execute it via a command‑line interpreter. Because the binary’s full path matches one of the hard‑coded selectors in the Sigma rule, Sysmon will log the process creation, causing the rule to fire.

• Regression Test Script: (run as the compromised user)

  # ---------------------------------------------------------
  # Simulate AGEWHEEZE RAT drop and execution for detection testing
  # ---------------------------------------------------------
  
  # 1. Define target install path (one of the detection selectors)
  $targetDir = "$env:APPDATASysSvc"
  $targetExe = "SysSvc.exe"
  $fullPath = Join-Path -Path $targetDir -ChildPath $targetExe
  
  # 2. Ensure the directory exists
  if (-not (Test-Path -Path $targetDir)) {
      New-Item -ItemType Directory -Path $targetDir -Force | Out-Null
  }
  
  # 3. Create a dummy executable (here we copy notepad.exe as a stand‑in)
  $sourceExe = "$env:SystemRootSystem32notepad.exe"
  Copy-Item -Path $sourceExe -Destination $fullPath -Force
  
  # 4. Execute the copied binary (simulating the RAT launch)
  Start-Process -FilePath $fullPath -WindowStyle Hidden
  
  # 5. Optional: write a marker to the console for verification
  Write-Host "AGEWHEEZE RAT simulation executed from $fullPath"
  # ---------------------------------------------------------

• Cleanup Commands: (run after validation)

  # ---------------------------------------------------------
  # Cleanup AGEWHEEZE RAT simulation artifacts
  # ---------------------------------------------------------
  
  $targetDir = "$env:APPDATASysSvc"
  $targetExe = "SysSvc.exe"
  $fullPath = Join-Path -Path $targetDir -ChildPath $targetExe
  
  # Terminate any lingering process that matches the dummy exe
  Get-Process -Name "notepad" -ErrorAction SilentlyContinue |
      Where-Object { $_.Path -eq $fullPath } |
      Stop-Process -Force
  
  # Remove the binary and its folder
  Remove-Item -Path $fullPath -Force -ErrorAction SilentlyContinue
  # Remove the directory if empty
  if ((Get-ChildItem -Path $targetDir -Force | Measure-Object).Count -eq 0) {
      Remove-Item -Path $targetDir -Force
  }
  
  Write-Host "Cleanup complete."
  # ---------------------------------------------------------