216.73.217.22

UAC-0063

· Published 21/12/2025 09:53 · Modified 29/05/2026 12:19 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 09:53
Modified
29/05/2026 12:19
Updated at
29/05/2026 12:19
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
2 reports, 25 attack patterns (mitre), 5 malware, 1 sectors, 12 countries, 25 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (2)

Attack patterns (MITRE) (25 / 30)

  • T1027.002 uses
    Software Packing
  • T1056.001 uses
    Keylogging
  • T1005 uses
    Data from Local System
  • T1120 uses
    Peripheral Device Discovery
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1053.005 uses
    Scheduled Task
  • T1566 uses
    Phishing
  • T1573.002 uses
    Asymmetric Cryptography
  • T1543.003 uses
    Windows Service
  • T1204.002 uses
    Malicious File
  • T1071.001 uses
    Web Protocols
  • T1571 uses
    Non-Standard Port
  • T1132 uses
    Data Encoding
  • T1074 uses
    Data Staged
  • T1082 uses
    System Information Discovery
  • T1036 uses
    Masquerading
  • T1573.001 uses
    Symmetric Cryptography
  • T1204 uses
    User Execution
  • T1105 uses
    Ingress Tool Transfer
  • T1555 uses
    Credentials from Password Stores
  • T1053 uses
    Scheduled Task/Job
  • T1027 uses
    Obfuscated Files or Information
  • T1083 uses
    File and Directory Discovery
  • T1518 uses
    Software Discovery
  • T1112 uses
    Modify Registry

Malware (5)

  • DownExPyer uses
    Family
    Published 29/01/2025 13:06 · Modified 29/01/2025 13:06
  • HATVIBE uses
    Family
    Published 22/05/2025 21:54 · Modified 22/05/2025 21:54
  • CHERRYSPY uses
    Family
    Published 22/05/2025 21:54 · Modified 22/05/2025 21:54
  • PyPlunderPlug uses
    Family
    Published 22/05/2025 21:54 · Modified 22/05/2025 21:54
  • LOGPIE uses
    Family
    Published 22/05/2025 21:54 · Modified 22/05/2025 21:54

Sectors (1)

  • Government targets

Countries (12)

  • Kyrgyzstan targets
  • Georgia targets
  • Belgium targets
  • Uzbekistan targets
  • Germany targets
  • Kazakhstan targets
  • Turkmenistan targets
  • Afghanistan targets
  • Netherlands targets
  • Tajikistan targets
  • Mongolia targets
  • Romania targets

Indicators (25 / 39)

  • background-services.net indicates
  • efc99e6f3cdd10313c52a8ad099424e3f39ab85b75375b8db82717d61c7f0118 indicates
  • 3b87dc25a11b6268019d5eae49a6b93271dfdc262f2607cfefa35d196f724997 indicates
  • internalsecurity.us indicates
  • automation-embedding.com indicates
  • apt_UAC0063_HATVIBE_loader_obfuscated_VBA indicates
  • 06e4084e2d043f216c0bc7931781ce3e1cea4eca1b6092c0e34b01a89e2a6dea indicates
  • 0fa7e3ffb8a9ca246cc1f1e3f6118ced7a7b785de510d777b316dfcefdddb0be indicates
  • 332d9db35daa83c5ad226b9bf50e992713bc6a69c9ecd52a1223b81e992bc725 indicates
  • d21f2469cacf40de30e62b372e9dd576bdbd95ac indicates
  • e3a0be8852d77771dc3f44f3e9a051e7fe56547b569aad5a178ae44ef31713b9 indicates
  • retaildemo.info indicates
  • lookup.ink indicates
  • certstorecheck.ht indicates
  • https://cloud-mail.ink/download.php indicates
  • 937b30aef519c49dd523736c2af94489bab6d9f9 indicates
  • bbb678f7214580d290db3b6aeb1fab09df3d680a indicates
  • rss-feed-monitoring.com indicates
  • fd78051817b5e2375c92d14588f9a4ba1adc92cc1564e55e6150ae350ed6c889 indicates
  • tieringservice.com indicates
  • apt_UAC0063_HATVIBE_loader_deobfuscated_VBA indicates
  • etaildemo.info indicates
  • c61e9326421d05d62cafd6c04041ab1a8f57c0a21d424b9ca04b6a1fc275af19 indicates
  • 2fa44b62209f7181ad91a06af294f13daa096b29 indicates
  • underwearshopfor.com indicates