PhantomCaptcha
Also known asUAC-0244 · UAC-0247
Summary
Espionage cluster against Ukraine's war-relief, public-health and defence communities. SentinelLABS named it PhantomCaptcha after a single-day operation on 8 October 2025: emails impersonating the Ukrainian President's Office carried PDFs (T1566.002) that led members of the ICRC, UNICEF Ukraine, the Norwegian Refugee Council, the Council of Europe's Register of Damage and four regional administrations to a fake Zoom site with a ClickFix-style captcha (T1204.004), which ran a three-stage PowerShell chain ending in a WebSocket RAT (T1059.001). CERT-UA tracks it as UAC-0244, into which UAC-0247 was merged in April 2026: in March–April 2026 humanitarian-aid lures led hospitals and municipalities to LNK and HTA chains (T1218.005) that inject shellcode (T1055) and install the AGINGFLY RAT and the SILENTLOOP downloader, which reads its C2 address from Telegram (T1102.001). Browser and WhatsApp data is stolen (T1555.003), traffic tunnelled with Ligolo-ng and Chisel (T1572), and XMRig mined in one case (T1496). A trojanised "BACHU" FPV-operator tool was spread over Signal by DLL side-loading (T1574.001). ESET reports it among Russia-aligned activity, adding PrincessSpy Android spyware spread through fake ab3.army sites. SentinelLABS sees overlaps with COLDRIVER but has not extended that attribution; no government has attributed it, so the tier is suspected.
Attribution
ESET lists it with Russia-aligned groups; SentinelLABS: COLDRIVER overlaps, unconfirmed
Hedged, circumstantial or press-only reporting; not established.
- ESET Research (Research, 2026-10-28)
Reported within its summary of Russia-aligned APT activity - SentinelLABS (Research, 2025-10-22)
Attack chain overlaps COLDRIVER activity; attribution not extended
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| PrincessSpy Android spyware through fake ab3.army sites; UAC-0244 TTPs against dozens of ESET users | 2026-04 – 2026-09 | Ukraine | Defense | ESET APT Activity Report Q2–Q3 2026 (2026-10-28) — within the Apr–Sep 2026 reporting period |
| Hospitals, municipalities and FPV operators — AGINGFLY, SILENTLOOP, trojanised BACHU | 2026-03 – 2026-04 | Ukraine | Healthcare, Government, Defense | CERT-UA (2026-04-15, updated 2026-04-20) — as UAC-0247, merged into UAC-0244 |
| Single-day ClickFix spearphishing against Ukraine war-relief NGOs and regional administrations | 2025-10 | Ukraine | NGO, Government | SentinelLABS (2025-10-22) — emails sent 8 Oct 2025; infrastructure from 27 Mar 2025 |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Initial Access1 | T1566.002Spearphishing Link |
|---|---|
| Execution2 | T1204.004Malicious Copy and PasteT1059.001PowerShell |
| Stealth3 | T1218.005MshtaT1055Process InjectionT1574.001DLL |
| Credential Access1 | T1555.003Credentials from Web Browsers |
| Command and Control2 | T1102.001Dead Drop ResolverT1572Protocol Tunneling |
| Impact1 | T1496Resource Hijacking |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| AGINGFLY | RAT | Windows |
| SILENTLOOP | PowerShell downloader | Windows |
| RAVENSHELL | Reverse shell | Windows |
| PrincessSpy | Spyware | Android |
| ZAPIXDESK | Stealer | Windows |
| PowerShell WebSocket RAT | RAT | Windows |
Infrastructure patterns
- Fake Zoom lure domain on a Russian-provider (KVMKA) VPS in Finland, live for one day (SentinelLABS, 2025)
- Backend C2 kept separate from lure domains and left running after takedown (SentinelLABS, 2025)
- SILENTLOOP reads its current C2 address from a Telegram channel, with fallbacks (CERT-UA, 2026)
- ab3army[.]in, .info, .com and .org impersonate ab3.army to spread PrincessSpy (ESET, 2026)