Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Ukrainian Cyber Alliance · Unknown · assessed origin Ukraine · misp-galaxy · refreshed 2026-10-06

Ukrainian Cyber Alliance

  • UCA

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2023-22515

Analyst brief

misp-galaxy

Cyber Alliance is a hacktivist group that has demonstrated capabilities in exploiting vulnerabilities, such as CVE-2023-22515 in Confluence, to escalate privileges and access targeted infrastructure. They successfully accessed Trigona's systems, exfiltrating sensitive data and ultimately defacing and deleting the organization's site.

CVEs Ukrainian Cyber Alliance is cited as exploiting

none on KEV
  1. CVE-2023-225152026-10-17
    1. “Last fall, the Ukrainian Cyber Alliance (UCA) used CVE-2023-22515, which involves Confluence, to escalate privileges and access Trigona’s confluence server.”

      cited as exploiting · source: darkowl.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

3 rules · Sigma · QRadar · Cortex

  1. CVE exploitation

    CVE-2023-22515 exploitation attempt

    CVE-2023-22515 · Storm-0062 · Ukrainian Cyber Alliance

    T1190conf 70SIGAQLXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

3 sources
  1. 1.unit42.paloaltonetworks.com/unit-42-ransomware-leak-site-data-analysis
  2. 2.securelist.com/cyber-anarchy-squad-attacks-with-uncommon-trojans/1149…
  3. 3.darkowl.com/blog-content/what-are-cves

Track Ukrainian Cyber Alliance on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.