From clinics to government: UAC-0247 expands cyber campaign across Ukraine

CERT-UA attributes a March–April 2026 campaign to UAC-0247 that targeted Ukrainian government bodies and municipal healthcare facilities using phishing (malicious LNK/HTA) to deploy multi-stage malware (including AGINGFLY, SILENTLOOP, CHROMELEVATOR, ZAPIXDESK) for browser and WhatsApp credential theft, remote control, lateral movement, and persistence via techniques such as scheduled tasks, DLL side‑loading, process injection, custom loaders, and encrypted C2 channels (Telegram, AES‑CBC websockets).