UAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government via HTML Smuggling

According to threat intelligence reporting, the Russia-aligned actor UAC-0099 has been conducting operations against Ukrainian government personnel using a newly identified malware strain designated ASHVEIN. The malware functions as both an infostealer and a remote access trojan (RAT) and is developed using the .NET framework.

The attack chain begins with HTML smuggling, a technique in which malicious HTML files are delivered to targets, often via phishing or social engineering vectors. These HTML files contain obfuscated commands that, when executed, download and run the ASHVEIN payload on the victim's system. Trend Micro (referred to as TrendAI in the source) attributes the campaign to the cluster Earth Sirrush, previously tracked as SHADOW-EARTH-065.

The use of HTML smuggling allows the threat actor to bypass traditional email security attachments filters, as the malicious payload is reconstructed only after the HTML file is opened in the browser. Once executed, ASHVEIN is capable of exfiltrating sensitive data, harvesting credentials, and providing remote control over the compromised host.

The reporting does not attribute the activity to a specific CVE or zero-day vulnerability, instead relying on social engineering and HTML-based delivery to achieve initial access. The full extent of the campaign's victim count and the specific command-and-control infrastructure remain under investigation.