Uac-0165

UAC-0165 is a malware reportedly linked to the Russia-affiliated Advanced Persistent Threat (APT) group known as Sandworm. This malicious software, designed to infiltrate and damage computer systems, has been identified as the tool used in a series of cyberattacks on Ukrainian telecommunications service providers. These attacks occurred between May and September 2023, with Sandworm successfully compromising eleven different providers during this period. The Ukraine's Computer Emergency Response Team (CERT-UA) was instrumental in identifying the threat actor behind these attacks. After thorough investigation, CERT-UA attributed the cyberattacks to the Sandworm group (UAC-0165), which is believed to be one of Russia's military cyber units. This conclusion was based on the distinctive tactics, techniques, and procedures employed by the attackers, along with the specific characteristics of the UAC-0165 malware. These incidents have highlighted the significant cybersecurity threats facing telecommunication service providers, particularly those operating in geopolitical hotspots like Ukraine. The successful compromise of eleven providers over a span of just five months underscores the sophistication and persistence of groups like Sandworm. Moving forward, it will be crucial for organizations in this sector to bolster their defensive measures, continually monitor for signs of intrusion, and collaborate closely with entities like CERT-UA to respond effectively to such threats.