UAC-0097
Attribution profile
- Type
- Spy
- Location
- India
- Known incidents
- 2 incidents
- Sources
- 0 sources
- First seen
- 2022-04-14
- Last seen
- 2022-04-14
- Updated
- 2026-10-18 10:39
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
UAC-0097, also known by its alias, is a threat actor linked to India and observed in an April 2022 campaign against Ukrainian government agencies. The actor used phishing emails with malicious Excel documents to deliver the IcedID banking trojan, which functions as a credential stealer and malware loader, and exploited a Zimbra vulnerability to create email forwarding rules for data exfiltration. These actions were aimed at cyber‑espionage against critical government infrastructure. UAC-0097 was attributed by CERT‑UA alongside the known cluster UAC-0041, though no public state or criminal affiliation has been established for UAC-0097 itself. The April 2022 operation remains the actor’s only publicly reported activity.
Incidents
Attributed incidents are available to members.
2 incidentsSources
Sources available to members: 0 sources.