UAC-0173 Resumes Targeted Cyberattacks On Ukrainian Notary Offices

CERT-UA warns that the financially motivated criminal group UAC-0173 resumed targeted phishing attacks against Ukrainian notary offices in early 2025, distributing malicious executables (including DARKCRYSTALRAT) to achieve remote access, install RDP backdoors and persistence, steal credentials (XWORM, FIDDLER), and attempt unauthorized modifications of state registers; the report includes file hashes, malicious domains/IPs, persistence paths, and mitigation guidance.