{"id":3087,"date":"2025-04-08T14:33:52","date_gmt":"2025-04-08T13:33:52","guid":{"rendered":"https:\/\/aegislens.com\/home\/?p=3087"},"modified":"2025-05-31T14:40:33","modified_gmt":"2025-05-31T13:40:33","slug":"uncovering-uac-0226-how-giftedcrook-stealer-exploits-excel-files-to-breach-security-in-ukraine","status":"publish","type":"post","link":"https:\/\/aegislens.com\/home\/uncovering-uac-0226-how-giftedcrook-stealer-exploits-excel-files-to-breach-security-in-ukraine\/","title":{"rendered":"Uncovering UAC-0226: How GiftedCrook Stealer Exploits Excel Files to Breach Security in Ukraine"},"content":{"rendered":"

containing malicious Excel files, and are reported to be the work of a nefarious campaign dubbed as UAC-0226.<\/p>\n

\n
Cyber Espionage at Play<\/h2>\n\n
The sophisticated threat group, UAC-0226, also known as Turla, Venomous Bear, or Waterbug, has been on the radar of international cybersecurity agencies for quite some time.<\/p>
The group's hallmark is state-sponsored cyber-espionage against targets of strategic importance.<\/p>
Over the past week, the group reportedly launched a new campaign where they deployed a new variant of info-stealer malware - GIFTEDCROOK.<\/p>\n\n
Distribution: Crafty Phishing Tactics <\/h2>\n\n
In this new attack, the adversaries leverage spear phishing emails impersonating known military institutions.<\/p>
Within the emails are malicious Excel files with a macro script hidden inside.<\/p>
The email encourages the receiver to open the Excel file by creating a sense of urgency.<\/p>\n\n
Mechanics of GIFTEDCROOK Malware<\/h2>\n\n
Once the victim opens the file and enables macros, the hidden Visual Basic for Applications (VBA) script is executed.<\/p>
This initiates a multi-stage infection chain where GIFTEDCROOK malware is downloaded and installed on the target system.<\/p>
Its main purpose is information theft, allowing the threat actor to exfiltrate sensitive data, such as login credentials or confidential documents.<\/p> \n\n
Recommendations for Safety<\/h2>\n\n
Adopting practical precautions is key to staying protected from such sophisticated attacks.<\/p>
These include:<\/p>\n\n