File · UAC-0099 · Unknown · misp-galaxy · refreshed 2026-10-06
UAC-0099
sigil · no ATT&CK coverage stated
Last 30 days
last seen 9 d agoWhat changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2023-38831
- —8 d agoresurfacedback on the wire — nothing in the previous 30 days
Analyst brief
misp-galaxyUAC-0099 is a threat actor that has been active since at least May 2023, targeting Ukrainian entities. They have been observed using a known WinRAR vulnerability to carry out attacks, indicating a level of sophistication. The actor relies on PowerShell and the creation of scheduled tasks to execute malicious VBS files for initial infection. Monitoring and limiting the functionality of these components can help mitigate the risk of UAC-0099 attacks.
CVEs UAC-0099 is cited as exploiting
none on KEV- CVE-2023-388312026-10-17
“The threat actor was observed leveraging CVE-2023-38831”
cited as exploiting · named nearby · source: deepinstinct.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
2 sourcesTrack UAC-0099 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.