Sophisticated Phishing Campaign Targets Ukraine’s Largest Bank

CloudSEK has identified an active phishing campaign by financially motivated group UAC-0006 targeting PrivatBank customers. The campaign uses password-protected ZIP/RAR attachments that drop JavaScript/VBScript or LNK files which run PowerShell, perform process injection, and deploy SmokeLoader for C2, enabling credential theft and persistent access; recommended mitigations include blocking malicious indicators, user training, and incident response preparedness.