Hackers Clone CERT-UA Site to Trick Victims Into Installing Go-Based RAT

A phishing campaign tracked as UAC-0255 impersonated Ukraine’s CERT-UA by cloning the official site (cert.gov.ua) at cert-ua.tech and sending emails that urged recipients to download password-protected archives containing AGEWHEEZE, a Go-based remote access trojan; the malware installs in user AppData, creates registry Run entries and scheduled tasks (SvcHelper/CoreService) for persistence, and connects to C2 at 54.36.237.92 over WebSockets on port 8443. Investigators found domain and SSL artifacts, a Telegram channel claim by the actor calling themselves CYBER SERP, and limited infections mostly on personal devices at educational institutions before rapid takedown and remediation limited spread.