Cybercrime
UAC-0099
0mentions, 7 days
7mentions, 30 days
Oct 30, 2026last mentioned
UAC-0099 is a threat actor that has been active since at least May 2023, targeting Ukrainian entities. They have been observed using a known WinRAR vulnerability to carry out attacks, indicating a level of sophistication. The actor relies on PowerShell and the creation of scheduled tasks to execute malicious VBS files for initial infection. Monitoring and limiting the functionality of these components can help mitigate the risk of UAC-0099 attacks.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- Threat Actors to Watch 2026: APT41 and UAC-0099 https:// packetstorm.news/news/view/467 53 # newsmastodon · Oct 30, 2026
- Threat Actors to Watch 2026: APT41 and UAC-0099 https:// packetstorm.news/news/view/467 53 # newsmastodon · Oct 29, 2026
- MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration https://www. welivesecurity.com/en/eset-res earch/mythicratatoskr-ymastodon · Oct 25, 2026
- 'On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment ... '.mastodon · Oct 23, 2026
- 🚨 Russian state-sponsored Sandworm wiped a Ukrainian logistics firm after UAC-0099 handed over access. The intrusion involved a new backdoor, MythicRatatoskr, mastodon · Oct 23, 2026
- ESET reports Sandworm collaborated with UAC-0099 to wipe a Ukrainian logistics company, leveraging UAC-0099 initial access and the new MythicRatatoskr backdoor.mastodon · Oct 23, 2026
- MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration ESET researchers have uncovered MythicRatatoskr, a previously unknomastodon · Oct 23, 2026
References
- https://cert.gov.ua/article/4818341
- https://www.deepinstinct.com/blog/threat-actor-uac-0099-continues-to-target-ukraine
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.