Russia-Aligned UAC-0184 Targets Ukrainian Military via Viber Phishing Campaign

The Russia-linked advanced persistent threat group UAC-0184, also known as Hive0156, has intensified its espionage operations against Ukrainian military and government entities by leveraging the Viber messaging platform as an initial attack vector. The group distributed malicious ZIP archives disguised as official documents, which contained Windows shortcut (LNK) files masquerading as Microsoft Word, Excel, and other document types. When opened, these LNK files executed a multi-stage infection chain, including the deployment of the Hijack Loader malware, which facilitated further compromise through techniques such as DLL side-loading, module stomping, and in-memory execution to evade detection. The phishing lures exploited sensitive themes, such as military personnel record changes and compensation issues, to increase the likelihood of successful compromise.

The attack chain involved the use of PowerShell scripts to download additional payloads, with the malware designed to scan for and evade common security software. Persistence was established via scheduled tasks, and the campaign was observed to target high-value Ukrainian government bodies, including the Verkhovna Rada. Security researchers recommend strengthening security awareness, encryption, and access controls to mitigate the risk from such sophisticated phishing and malware delivery tactics. The campaign is expected to continue, with UAC-0184 evolving its methods and maintaining a focus on intelligence gathering against Ukrainian targets.