{
  "name": "UAC-0173 against the Notary Office of Ukraine",
  "slug": "uac-0173-against-the-notary-office-of-ukraine",
  "description": "A criminal group, UAC-0173, has resumed cyberattacks targeting notaries in Ukraine to gain unauthorized access to state registers. The attackers use phishing emails with malicious executable files to infect computers with DARKCRYSTALRAT malware. They then install additional tools like RDPWRAPPER and BORE for remote access, and employ various programs to bypass security measures and steal authentication data. The group uses compromised computers to send further malicious emails. CERT-UA, with the help of the Notary Chamber of Ukraine, has identified affected computers in six regions and prevented unauthorized actions. Authorities urge notaries to remain vigilant and report suspicious activities immediately.",
  "published": "2025-02-26T09:00:04+00:00",
  "created_at": "2025-02-26T09:00:04+00:00",
  "modified_at": "2025-02-26T09:26:56+00:00",
  "created_at_opencti": "2025-02-26T09:00:04+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-26",
    "darkcrystalrat",
    "dcrat",
    "peaklight",
    "rdpwrapper",
    "state registers",
    "xworm"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.92.246.18"
      },
      {
        "id": "",
        "name": "89.105.201.98"
      },
      {
        "id": "",
        "name": "87.120.126.48"
      },
      {
        "id": "",
        "name": "194.0.234.155"
      },
      {
        "id": "",
        "name": "193.233.48.166"
      },
      {
        "id": "",
        "name": "https://upnow-prod.ff45e40d1a1c8f7e7de4e976d0c9e555.r2.cloudflarestorage.com/fnwimqzwkbgtpmknfy9oi9pg4kr2/aac53"
      },
      {
        "id": "",
        "name": "faf84596ee6e19058e6ae60b5c54fb587358ab8069b21c64d82393748910b46c"
      },
      {
        "id": "",
        "name": "f9d5f5b0b924a4ba903fdef291bfe8eae7e7f18d048a6d3222385d442244df38"
      },
      {
        "id": "",
        "name": "f5ab745071556175c327408c4d898e082ae93544045200083cd42f50f28ee797"
      },
      {
        "id": "",
        "name": "ed8754074b43da6604dc98dab26794334a84538136fa013897cb19f3aa9db04c"
      },
      {
        "id": "",
        "name": "d6fe0aea4b4cc5f3217cd81d73b1b04e94bf7e74f50f4ae50819699205104fe7"
      },
      {
        "id": "",
        "name": "c8c475ff518943b3b807b10e29b6bd5c644ac1408f7f320082be6fe5a8b1d1ef"
      },
      {
        "id": "",
        "name": "afec811864ccca244a9eda1591185ca8bf8060f62c098e13231463d76f5d9afc"
      },
      {
        "id": "",
        "name": "ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753"
      },
      {
        "id": "",
        "name": "a2b5c2990a64b16f5a6c4d612dc2519ad9c0262e0f9bdf3f9409278af4bcce66"
      },
      {
        "id": "",
        "name": "8f8187d425384e17cdcec48dac499775247c5174264ff21461020dad1d94ac7c"
      },
      {
        "id": "",
        "name": "8ee10f65476a211ee82a7e06319bc48af7061fcc847753d551e963b4df1ac89f"
      },
      {
        "id": "",
        "name": "8d4f01ab275d51d02ab864fb5c449e23b799a60b6a12ceec9a7f7c7e46e383b5"
      },
      {
        "id": "",
        "name": "884e86732f0c0ccb7d802a4fd6f08d707fbd053a2e7ffd99934f730f8851a36a"
      },
      {
        "id": "",
        "name": "798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4"
      },
      {
        "id": "",
        "name": "7120b8beef9967442ab23dd5b7d7d7c27b6b99a4ce1010cc8a4b7c92c7ef9cdb"
      },
      {
        "id": "",
        "name": "6f888cf4cb68afa200ef74dde20b1354487ef20d11b72b897646048a12c3e62d"
      },
      {
        "id": "",
        "name": "6f37d60bd918ae4733abeffa98457409e838697c09c23fcf11e42736775a96b3"
      },
      {
        "id": "",
        "name": "69f11f28b67cda8daa3d3ae4a34abe0ddcb7da97e710dfb55d6cff7280eb3880"
      },
      {
        "id": "",
        "name": "65ed24335a34fe670daa098a15d507633a6c765f0974bf80dab828a278d59a59"
      },
      {
        "id": "",
        "name": "4b9740cfff070286e01785d9b1492c1b66246cadc851fbd5c1fe485977287459"
      },
      {
        "id": "",
        "name": "3e0628c33fb6abb952571c873e2627c746d797580cd6418c8015c581b89a0051"
      },
      {
        "id": "",
        "name": "3788802d0823e330707ee80bb96ef29e89af93d95fd9ef822948d06c31398d39"
      },
      {
        "id": "",
        "name": "35db3d73f8a56bfef47acb65ccc8a6a647fd383a03e618a2ffa05be75a7a418c"
      },
      {
        "id": "",
        "name": "353f2dc17a4e80564caa175f7170dbedc1b40f704444520ae671f78a5d1f2b6d"
      },
      {
        "id": "",
        "name": "256bf164fbfd8bf52c47f08c73492854601a8579b642d72f7b9facae1f7e1d35"
      },
      {
        "id": "",
        "name": "20e9ad367dd61cf76d9aa1bd6993cf2c6a289b433d44fb445b0fb6d8a634fd03"
      },
      {
        "id": "",
        "name": "2030e37e7abfd5d6d25f570c221bbc0fc00bfc7f4647462fdc121b558e01417e"
      },
      {
        "id": "",
        "name": "1dd4acdd9616469545afb31d3673e78565fdb29611426285d88138aeb81f905f"
      },
      {
        "id": "",
        "name": "0bf2cfdcfd825b02e59a230f51a36cbe2e39f473ad87746bb9038191eb8112c4"
      },
      {
        "id": "",
        "name": "022364ee1fce61c8a867216c79f223bf47692cd648e3fd6b244fc615b86e4c58"
      }
    ],
    "malware": [
      {
        "id": "1c1afb0e-66a4-4757-92ab-47c07b2594a0",
        "name": "BORE",
        "slug": "bore"
      },
      {
        "id": "67eb9c32-39cb-4f14-92ca-efd89fa58c40",
        "name": "RDPWRAPPER",
        "slug": "rdpwrapper"
      },
      {
        "id": "2da46560-8a02-4ce3-8489-d1aeb8e4f9d4",
        "name": "DARKCRYSTALRAT",
        "slug": "darkcrystalrat"
      },
      {
        "id": "8df73b60-44a0-4288-ac4f-d9027c6ea39a",
        "name": "PEAKLIGHT",
        "slug": "peaklight"
      },
      {
        "id": "eb832bdd-0dcb-4866-8f63-4dd299798562",
        "name": "DCRAT",
        "slug": "dcrat"
      },
      {
        "id": "82e2ea8e-729a-4648-ba23-3a792f53fa15",
        "name": "XWorm",
        "slug": "xworm"
      }
    ],
    "intrusion_sets": [
      {
        "id": "270507d4-b4c9-4cb1-961f-aa11ca00248d",
        "name": "UAC-0173",
        "slug": "uac-0173"
      }
    ],
    "attack_patterns": [
      {
        "id": "1e73eaa9-ea78-444b-b3a3-5842f5d35115",
        "name": "T1074"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "fc699aef-8931-4a79-8f79-9651be9abd50",
        "name": "T1021"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "60972cf6-e90b-4600-af3c-13c468391d9c",
        "name": "T1106"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/67bee62443a988114439d34e"
  ]
}