The government cyber incident response team CERT-UA, which operates under the State Service for Special Communications, has recorded a new phishing attack by the UAC-0050 group on Ukrainian state institutions. The attackers are mass-sending malicious emails under the guise of energy professionals in order to gain covert remote access to victims' computers.
The government cyber incident response team CERT-UA, which operates under the State Service for Special Communications, has recorded a new phishing attack by the UAC-0050 group on Ukrainian state institutions. The attackers are mass-sending malicious emails under the guise of energy professionals in order to gain covert remote access to victims' computers.
A phishing wave was recorded on October 29, 2026. Hackers sent messages about allegedly repaying electricity debts on behalf of an accountant from DTEK Energy.
The Cyber Police emphasize that this attack is especially dangerous against the backdrop of constant hostile attacks on energy infrastructure and forced power outages.
To bypass basic security systems, the hackers used a multi-stage scheme. The victim received an email with an attached PDF file containing a link supposedly for "paying a debt." Clicking on the link would trigger the download of a RAR archive from the DigitalOcean Spaces cloud storage.
Inside the first archive was a second password-protected RAR archive, as well as a text file (.txt) with a key to extract it. Inside was an executable EXE file (SFX archive). Running it silently installed a legitimate remote control program called LiteManager.
As a result, the program was registered as a system service that would start automatically when the PC was turned on, which provided hackers with constant control over the device.
To mask its network infrastructure, the UAC-0050 group used a familiar technique: the LiteManager configuration file contained a large list of IP addresses and domain names. Most of them belonged to completely safe and legitimate resources, and only a few addresses were used for actual communication with hackers. This makes it much more difficult to detect the attack using standard network monitoring tools.
Specialists of the State Special Communications Service recommend following the basic rules of cyber hygiene:
be extremely careful with letters about urgent debts;
do not follow dubious links from PDF files and do not enter passwords to unpack unknown archives;
Check the status of accounts and debts exclusively through the official applications of service providers or their verified web portals.
