UAC-0050

Summary

Russia-aligned cyber cluster active since 2020, primary focus on Ukrainian government and critical infrastructure with expansion into EU financial institutions since 2024. Tracked by Ukraine's CERT-UA as UAC-0050 and self-branded as 'Fire Cells Group' in intimidation messages. A February 2026 campaign that BlueVoyant assesses as UAC-0050 ("exhibits hallmarks") targeted a European financial institution using spoofed Ukrainian bank domains to deploy RMS (Remote Manipulator System) remote access malware. Combines espionage, financial theft, and psychological/disinformation operations — unusual tradecraft blend suggesting contracted or hybrid operation. Heavy use of commodity RATs: Remcos, Quasar, Remote Utilities, Meduza Stealer.

Attribution

A mercenary outfit; operates as 'DaVinci Group'

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• CERT-UA, via BlueVoyant (Government, 2026-02)
  Ukraine's CERT assesses a mercenary group associated with Russian law enforcement
• Intrinsec (Research, 2025-03-28)
  Operates under a front agency named "DaVinci Group"

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 7

Malware and tools 5

Infrastructure patterns

• Bulletproof hosting on Karina Rashkovska and Virtualine networks (AS215789, AS214943) (Intrinsec, 2025)

Reporting and advisories 3

• BlueVoyant
  European Financial Institution Campaign
• CERT-UA
  Espionage, accountant-PC fund theft and Fire Cells Group psy-ops against Ukraine (CERT-UA "triad")
• Intrinsec
  Jan–Feb 2025 malspam (NetSupport Manager) against Ukraine and others