Over 100 Ukraine’s govt PCs infected with malware in new UAC-0198 campaign

Over 100 Ukraine’s govt PCs infected with malware in new UAC-0198 campaign

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new phishing campaign that is impersonating the Security Service of Ukraine (SSU) to infect computer systems with malware.

According to the agency, the threat actor, which it tracks as UAC-0198, has managed to infect more than 100 computer in Ukrainian government agencies’ networks with the AnonVNC malware.

The attackers used emails that appeared to be from the SSU, luring victims to click on a malicious link. Upon clicking, an MSI file named "Scan_docs#40562153.msi" was downloaded onto the victim computer.

When executed, this file deployed the AnonVNC (MESHAGENT) malware, granting the attackers unauthorized access to the compromised systems.

CERT-UA noted that some of the malware samples were signed using a code signing certificate from a company named Shenzhen Variable Engine E-commerce Co Ltd, which suggests the potential involvement of Chinese entities or the misuse of their credentials.

The AnonVNC malware contains a configuration file similar to that of MESHAGENT, an open-source software available on GitHub. CERT-UA said it is temporarily referring to the malware as AnonVNC, with a nod to its origins in MESHAGENT.

The agency said that the attacks have been ongoing since at least July 2024 and may have a broader geographical scope. Evidence suggests that the campaign extends beyond Ukraine, with over a thousand EXE and MSI files related to the attack campaign being uploaded to the file-sharing service pCloud since August 1, 2024.


Back to the list

Latest Posts

Cyber Security Week in Review: April 25, 2025

Cyber Security Week in Review: April 25, 2025

In brief: A SAP NetWeaver zero-day bug exploited in the wild, DslogdRAT exploits a recent Ivanti flaw, and more.
25 April 2025
ToyMaker: Financially-motivated IAB that sells access to ransomware gangs

ToyMaker: Financially-motivated IAB that sells access to ransomware gangs

ToyMaker is believed to be behind the custom backdoor dubbed ‘LAGTOY.’
24 April 2025
DragonForce and Anubis ransomware ops use novel models to attract affiliates and boost profits

DragonForce and Anubis ransomware ops use novel models to attract affiliates and boost profits

DragonForce introduced a distributed affiliate branding model.
23 April 2025