GetSmoked: UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank

The report documents an active phishing campaign attributed to UAC-0006 targeting customers of Ukraine's largest bank (PrivatBank). Attackers distribute password-protected archives containing malicious JavaScript, VBScript, or LNK files that use encoded PowerShell, process injection, and mshta-based techniques to deliver SmokeLoader and contact C2 infrastructure; the report provides IOCs (hashes, URLs, IPs), YARA rules, MITRE mapping, mitigation guidance, and notes TTP overlap with FIN7.