Hackers-for-hire target Ukrainian notaries to manipulate state registries

CERT‑UA warns that the UAC‑0173 group has run phishing campaigns since January against Ukrainian notaries, delivering DarkCrystal backdoor (and previously AsyncRAT) to achieve remote access, credential theft, and attempted manipulation of state registries; a separate group, UAC‑0212 (linked to Sandworm), targeted suppliers of industrial control components using EmpirePast, Spark and CrookBag. Authorities identified affected hosts across multiple regions, blocked unauthorized registry changes in several cases, and attribute motives ranging from financially motivated contracting to potential targeting of critical industrial infrastructure.