UAC-0020 (Vermin) is a Kremlin-linked cyber-espionage group targeting Ukraine's military and defense sectors.
Analyst brief
UAC-0020 (Vermin) is a cyber-espionage group linked to the Luhansk People's Republic and believed to operate on behalf of the Kremlin. They primarily target Ukraine's military and defense sectors. The group employs custom malware like Spectr and the Vermin RAT, alongside legitimate tools such as SyncThing for data exfiltration. Defenders should monitor for unusual network traffic, specifically SyncThing protocol activity, and focus on known indicators of compromise (IoCs) related to Spectr and Vermin.
UAC-0020
VerminSickSyncTEMP.Vermin
unknown
Vermin is a threat actor group linked to the Luhansk People’s Republic and believed to be acting on behalf of the Kremlin. They have targeted Ukrainian government infrastructure using malware like Spectr and legitimate tools like SyncThing for data exfiltration. Vermin has been active since at least 2018, using custom-made RATs like Vermin and open-source tools like Quasar for cyber-espionage. The group has resurfaced after periods of inactivity to conduct espionage operations against Ukraine's military and defense sectors.