{
  "name": "UAC-0057 Keeps Pressure on Ukraine and Poland",
  "slug": "uac-0057-keeps-pressure-on-ukraine-and-poland",
  "description": "This report details recent cyber espionage campaigns targeting Ukraine and Poland, likely conducted by UAC-0057 (also known as UNC1151 or Ghostwriter). The threat actor used weaponized XLS spreadsheets with obfuscated VBA macros to drop first-stage DLL downloaders. C# and C++ downloaders were used to collect system information and retrieve next-stage payloads. The infrastructure leveraged domains impersonating legitimate websites, with consistent setups across campaigns. Notable evolutions include the use of Slack for command and control in some instances. The campaigns maintained disciplined targeting of Ukrainian and Polish organizations, consistent with UAC-0057's historical focus.",
  "published": "2025-08-27T17:54:30+00:00",
  "created_at": "2025-08-27T17:54:30+00:00",
  "modified_at": "2025-08-27T18:27:35+00:00",
  "created_at_opencti": "2025-08-27T17:54:30+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-08-27",
    "cobalt strike",
    "confuserex",
    "cyber espionage",
    "domain impersonation",
    "downloaders",
    "poland",
    "ukraine",
    "upx",
    "vba macros"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "cdn1.sweetgeorgiayarns.com"
      },
      {
        "id": "",
        "name": "taskandpurpose.icu"
      },
      {
        "id": "",
        "name": "sweetgeorgiayarns.com"
      },
      {
        "id": "",
        "name": "sweetgeorgiayarns.online"
      },
      {
        "id": "",
        "name": "punandjokes.icu"
      },
      {
        "id": "",
        "name": "punandjokes.com"
      },
      {
        "id": "",
        "name": "pesthacks.icu"
      },
      {
        "id": "",
        "name": "pesthacks.com"
      },
      {
        "id": "",
        "name": "medpagetoday.icu"
      },
      {
        "id": "",
        "name": "kitchengardenseeds.icu"
      },
      {
        "id": "",
        "name": "curseforge.icu"
      },
      {
        "id": "",
        "name": "kitchengardenseeds.com"
      },
      {
        "id": "",
        "name": "f6fec3722a8c98c29c5de10969b8f70962dbb47ba53dcbcd4a3bbc63996d258d"
      },
      {
        "id": "",
        "name": "deaa3f807de097c3bfff37a41e97af5091b2df0e3a6d01a11a206732f9c6e49c"
      },
      {
        "id": "",
        "name": "c7e44bba26c9a57d8d0fa64a140d58f89d42fd95638b8e09bc0d2020424b640e"
      },
      {
        "id": "",
        "name": "b39411abe494e2b04419a32c72fb1968ba745b3d7b04e9e8ebbab872df794b35"
      },
      {
        "id": "",
        "name": "aac430127c438224ec61a6c02ea59eb3308eb54297daac985a7b26a75485e55f"
      },
      {
        "id": "",
        "name": "a2a2f0281eed6ec758130d2f2b2b5d4f578ac90605f7e16a07428316c9f6424e"
      },
      {
        "id": "",
        "name": "8a057d88a391a89489697634580e43dbb14ef8ab1720cb9971acc418b1a43564"
      },
      {
        "id": "",
        "name": "7c77d1ba7046a4b47aec8ec0f2a5f55c73073a026793ca986af22bbf38dc948c"
      },
      {
        "id": "",
        "name": "730c1a02bb31d548d91ba23fce870b1dc53c4802ea4fcb0d293f96de670d74af"
      },
      {
        "id": "",
        "name": "707a24070bd99ba545a4b8bab6a056500763a1ce7289305654eaa3132c7cbd36"
      },
      {
        "id": "",
        "name": "6e562afa3193c2ca5d2982e04de78cf83faa203534a6098ab5f08df94bbeb944"
      },
      {
        "id": "",
        "name": "699c50014cdbe919855c25eb35b15dfc8e64f73945187da41d985a9d7be31a71"
      },
      {
        "id": "",
        "name": "69636ddc0b263c93f10b00000c230434febbd49ecdddf5af6448449ea3a85175"
      },
      {
        "id": "",
        "name": "5fa19aa32776b6ab45a99a851746fbe189f7a668daf82f3965225c1a2f8b9d36"
      },
      {
        "id": "",
        "name": "5df1e1d67b92e2bba8641561af9967e3a54ec73600283c66b09c8165ddcb7de9"
      },
      {
        "id": "",
        "name": "57e0280dc5b769186588cc3a27a8a9be6f6e169551bbef39f95127e9326627f2"
      },
      {
        "id": "",
        "name": "559ee2fad8d16ecaa7be398022aa7aa1adbd8f8f882a34d934be9f90f6dcb90b"
      },
      {
        "id": "",
        "name": "43688170c27bcb2649360e48e08540c52a2d41ef55a84033e8516ce53921ede5"
      },
      {
        "id": "",
        "name": "3fff6c8a8ef3f153ebbe6d469a0d970953358a25bb9b4955a2592626f011cbd6"
      },
      {
        "id": "",
        "name": "3b5980c758bd61abaa4422692620104a81eefbf151361a1d8afe8e89bf38579d"
      },
      {
        "id": "",
        "name": "34f97d0bd753d534d376725553b31de9860c2c96c96202a139281c6fa2bc85ee"
      },
      {
        "id": "",
        "name": "26ea842c4259c90349a1f4db92efa89ac4429a5ff380e7f72574426cfd647f1a"
      },
      {
        "id": "",
        "name": "082877e6f8b28f6cf96d3498067b0c404351847444ebc9b886054f96d85d55d4"
      },
      {
        "id": "",
        "name": "082903a8bec2b0ef7c7df3e75871e70c996edcca70802d100c7f68414811c804"
      },
      {
        "id": "",
        "name": "06380c593d122fc4987e9d4559a9573a74803455809e89dd04d476870a427cbe"
      }
    ],
    "malware": [
      {
        "id": "b63382fd-df5e-40fa-b63f-b245576b63b0",
        "name": "UPX",
        "slug": "upx"
      },
      {
        "id": "70c95639-1117-4193-8f68-2d01e5e6faa3",
        "name": "ConfuserEx",
        "slug": "confuserex"
      },
      {
        "id": "ab138766-9b64-4880-87fb-1942a709d778",
        "name": "Cobalt Strike - S0154",
        "slug": "cobalt-strike-s0154"
      }
    ],
    "intrusion_sets": [
      {
        "id": "85075d27-ebe7-49ba-ab31-53e5ff2640a2",
        "name": "UAC-0057",
        "slug": "uac-0057"
      }
    ],
    "attack_patterns": [
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "29398669-98ed-4766-9dac-f9632f7175ff",
        "name": "T1518"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "7abb6e8c-d357-49ef-9244-017043055224",
        "name": "T1205"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2024-42009"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Poland"
      },
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/#tid_chains_sim",
    "https://otx.alienvault.com/pulse/68af6276333998b0be9668fc"
  ]
}