Tracking Adversaries: UAC-0050, Cracking The DaVinci Code

The report analyzes UAC-0050, aka The DaVinci Group, a Russia-based mercenary/initial-access broker that has run repeated malspam campaigns against Ukrainian government, military, and civilian targets. The group uses commodity crimeware (Remcos, Quasar, Venom, LummaStealer) and legitimate RMM tools (RemoteUtilities), exposes IOCs (domains, file paths, email addresses), advertises services publicly on social media and cybercrime forums, and offers SIM/data 'probiv' services suggestive of insider access or corruption—raising concern about their role enabling higher-tier Russian APTs.