UAC-0247 Hits Ukrainian Government and Hospitals With AgingFly Espionage Malware

CERT-UA reported that threat cluster UAC-0247 targeted Ukrainian local governments, municipal clinics, emergency hospitals, and in some cases Defense Forces personnel with a phishing campaign delivering the newly identified AGINGFLY malware. The attacks used humanitarian-aid themed emails, compromised or fake websites, malicious archives, and LNK files that triggered mshta.exe to launch HTA payloads, scheduled tasks, and shellcode injection into legitimate processes before deploying RAVENSHELL, SILENTLOOP, and the C# backdoor AGINGFLY. Separate lures sent through Signal masqueraded as FPV drone operator software updates and used DLL side-loading to install the same malware.

The intrusions were aimed at espionage and data theft, with AGINGFLY enabling remote command execution, file exfiltration, screenshots, keylogging, and arbitrary code execution, while dynamically compiling command handlers received from command-and-control servers. CERT-UA said the operators also stole credentials from Chromium-based browsers with CHROMELEVATOR, extracted WhatsApp data with ZAPIXDESK, and used tools including RUSTSCAN, LIGOLO-NG, and CHISEL for reconnaissance, tunneling, and lateral movement; at least one incident also involved XMRIG delivered through a modified WireGuard binary, indicating cryptomining alongside espionage. The agency urged defenders to restrict execution of LNK, HTA, and JS files and limit abuse of mshta.exe, powershell.exe, and wscript.exe.