Ukraine’s Computer Emergency Response Team (CERT-UA) has detected a new campaign orchestrated by the UAC-0050 threat actor targeting government institutions.
The malicious email campaign involved attackers impersonating an accountant from energy company DTEK Energo. The emails claimed that recipients had outstanding electricity bills and urged them to settle their debts by following an embedded payment link.
According to CERT-UA, the attack employed a multi-stage malware delivery chain designed to bypass basic security controls. Victims received an email containing a PDF attachment with a link to download an archive hosted on DigitalOcean Spaces, a legitimate cloud storage service.
The downloaded RAR archive contained a second, password-protected RAR file and a TXT document providing the extraction password. The final payload was an executable (EXE) file functioning as a self-extracting (SFX) archive.
Once executed, the file installed the LiteManager remote administration software that attackers abused to establish persistent access to compromised systems. The software was installed as a Windows service configured to launch automatically at system startup, allowing attackers to maintain remote access to infected computers.
The LiteManager configuration file contained numerous IP addresses and domain names, most of which belonged to legitimate services. Only a small subset was used for actual command-and-control (C&C) communications. The technique complicates the identification and blocking of malicious infrastructure through conventional network monitoring.
The agency has warned that the campaign poses an additional risk amid ongoing Russian attacks against Ukraine’s energy infrastructure and resulting scheduled and emergency power outages.
CERT-UA advises users to exercise caution when handling emails demanding urgent debt payments. Recipients should avoid suspicious links, refrain from entering passwords to extract unknown archives, and verify outstanding balances exclusively through official energy provider applications or verified websites.