WRECKSTEEL
WRECKSTEEL is a PowerShell-based stealer/backdoor malware used in 2025 cyber-espionage campaigns against Ukraine and attributed by CERT-UA to the threat cluster UAC-0219. Reporting describes it as part of a short-duration "Steal & Go" intrusion model focused on rapid data theft rather than long-term persistence. It has been observed stealing data, taking screenshots, and exfiltrating sensitive information. Multiple sources in the provided content state that its PowerShell scripts were likely generated or assisted by AI tools. Delivery is described as phishing-driven: compromised email accounts sent messages containing links to legitimate services such as DropMeFiles and Google Drive, sometimes embedded in PDF attachments, and WRECKSTEEL was also delivered by a VBS script attached to or triggered by a malicious phishing message. The malware has been used against Ukrainian state administration bodies, critical infrastructure facilities, critical sectors, and the Ukrainian armed forces. The content consistently associates WRECKSTEEL with Russian state-backed cyber activity targeting Ukraine, especially during March 2025 and the first half of 2025. No specific file hashes or other unique IoCs for WRECKSTEEL are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UAC-0219 VBS → PS stealer (WRECKSTEEL) Partial, no LNK component
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive and exfiltration malware used in 2025 campaigns.
Stealer malware referenced in comparison to another campaign using a VBS to PowerShell chain.
Malware used in phishing-driven attacks against Ukrainian state administration bodies and critical infrastructure to steal sensitive data.
WRECKSTEEL is a stealer malware used to exfiltrate data and take screenshots from infected systems. It is likely enhanced with AI-generated PowerShell scripts for improved evasion or automation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.