Hackers Impersonate Ukrainian CERT to Plant a RAT on Government, Hospital Networks

A March 26–27 phishing campaign impersonated Ukraine’s CERT-UA, hosting a convincing fake site and distributing password-protected archives that installed AGEWHEEZE, a Go-written Remote Access Trojan. The RAT offers extensive remote-control and persistence mechanisms, communicates over WebSocket to OVH-hosted C2 infrastructure (port 8443), and was publicly claimed by the CyberSerp Telegram channel; CERT-UA labeled the campaign largely unsuccessful with only a few personal devices infected.