Koushik Pal

UAC-0006, a financially motivated cyber threat group, has resurfaced with a sophisticated phishing campaign targeting customers of Ukraine’s largest state-owned bank, PrivatBank. This campaign exploits password-protected archives containing malicious JavaScript, VBScript, and LNK files to bypass detection and deploy the SmokeLoader malware via process injection and PowerShell execution. With strong overlaps in tactics, techniques, and procedures (TTPs) with the notorious FIN7 and other Russian APTs, UAC-0006 aims to steal credentials and financial data while maintaining persistent access to compromised systems. Organizations must stay vigilant, enhance security awareness, and implement robust threat intelligence to counteract this growing cyber threat.

The Androxgh0st botnet, an emerging cyber threat since January 2024, has resurfaced with advanced capabilities and integration of IoT-focused Mozi payloads. Exploiting over 20 vulnerabilities in technologies like Cisco ASA, Atlassian JIRA, PHP frameworks, and IoT devices, Androxgh0st enables unauthorized access and remote code execution. Its growing sophistication includes shared infrastructure and malware persistence tactics, posing risks to global web servers and IoT networks. CloudSEK’s research highlights the botnet's operational overlap with Mozi, emphasizing the need for immediate patching and vigilant monitoring to mitigate exploitation risks​.