Defending Against the UAC-0255 Campaign: Detecting AGEWHEEZE & CERT-UA Impersonation

Introduction

In a concerning development highlighting the evolving sophistication of social engineering, threat actors tracked as UAC-0255 have launched a massive campaign impersonating the Computer Emergency Response Team of Ukraine (CERT-UA). By exploiting the inherent trust placed in security agencies, the attackers distributed a remote access trojan (RAT) known as AGEWHEEZE to approximately one million email addresses.

For defenders, this campaign underscores a critical reality: the "human firewall" is often the primary target. Even technical teams can be duped when urgent alerts appear to come from authoritative sources. This post analyzes the technical mechanics of the AGEWHEEZE delivery vector and provides detection rules and remediation steps to secure your organization against such impersonation tactics.

Technical Analysis

The Threat: UAC-0255 and AGEWHEEZE UAC-0255 is a threat cluster known for utilizing phishing campaigns to distribute malware. In this instance, the objective was to deploy AGEWHEEZE, a Remote Administration Tool (RAT). Once executed, AGEWHEEZE grants attackers full control over the infected host, including the ability to steal credentials, log keystrokes, and move laterally across the network.

The Vector: Impersonation and Password-Protected Archives The attack occurred on March 26 and 27, 2026. The emails were crafted to appear as official communications from CERT-UA. The primary delivery mechanism was a password-protected ZIP archive attached to the email.

Social Engineering: The email likely urged the recipient to open the attachment for critical security updates or threat intelligence.
Evasion: Attackers use password-protected ZIP files to bypass email security gateways. Since the archive is encrypted, automated scanners cannot inspect the internal contents, allowing the malicious payload to pass through to the inbox.
Execution: Upon extraction and execution of the file inside, the AGEWHEEZE payload is installed, establishing a command-and-control (C2) channel.

Severity: High. The volume of emails (1 million) suggests a broad, indiscriminate campaign, but the precision of the impersonation targets specific sectors likely involved in Ukrainian critical infrastructure or supporting entities.

Defensive Monitoring

To defend against this campaign, security operations centers (SOCs) must monitor for suspicious process lineage stemming from archive utilities and detect the behavioral indicators of AGEWHEEZE.

SIGMA Rules

The following SIGMA rules detect the execution of scripts from common archive extraction utilities and suspicious network connections typical of RAT behavior.

YAML

---
title: Suspicious Process Execution via Archive Tool
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious child processes spawned by common archive utilities like WinRAR or 7-Zip, which may indicate malicious payload execution following a phishing delivery.
references:
  - https://cert.gov.ua/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WinRAR.exe'
      - '\7zFM.exe'
      - '\7zG.exe'
      - '\explorer.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection
falsepositives:
  - Legitimate administrative tasks involving scripts from archives
level: high
---
title: Suspicious Network Connection by Scripting Interpreter
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects scripting interpreters like PowerShell or CMD initiating network connections, which is a common behavior for RATs like AGEWHEEZE establishing C2.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.execution
  - attack.t1059.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate system management tools using PowerShell remoting
level: medium

KQL Queries

Use these queries in Microsoft Sentinel or Microsoft Defender to hunt for indicators of this campaign.

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious process creations originating from archive tools
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("WinRAR.exe", "7zFM.exe", "7z.exe")
| where ProcessFileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "mshta.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine

// Hunt for AGEWHEEZE-like network activity (PowerShell making outbound connections)
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe")
| where RemotePort in (443, 80) or ActionType == "ConnectionSuccess"
| summarize count() by DeviceName, RemoteUrl, InitiatingProcessCommandLine

Velociraptor VQL

Hunt for suspicious file execution and process lineage on endpoints using Velociraptor.

VQL — Velociraptor

-- Hunt for processes spawned by common archive utilities
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Parent.Exe AS ParentExe
FROM pslist()
WHERE Parent.Name =~ "WinRAR" 
   OR Parent.Name =~ "7z"
   OR Parent.Name =~ "explorer"

-- Hunt for recently created ZIP files in user downloads
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:\Users\*\Downloads\*.zip")
WHERE Mtime > now() - 7d

PowerShell Remediation Script

This script can be used to audit recent processes spawned by archive tools for forensic review.

PowerShell

# Audit suspicious process lineage from archive tools
$archiveProcesses = @("WinRAR.exe", "7zFM.exe", "7zG.exe")
$suspiciousChildren = @("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")

Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} -MaxEvents 5000 | Where-Object {
    $event = $_
    $parentProc = $event.Properties[13].Value
    $childProc = $event.Properties[5].Value
    
    $archiveProcesses | Where-Object { $parentProc -like "*$_" } | Out-Null
    $isArchiveParent = $?
    
    $suspiciousChildren | Where-Object { $childProc -like "*$_" } | Out-Null
    $isSuspiciousChild = $?
    
    $isArchiveParent -and $isSuspiciousChild
} | Select-Object TimeCreated, @{N='ParentProcess';E={$_.Properties[13].Value}}, @{N='ChildProcess';E={$_.Properties[5].Value}}, @{N='CommandLine';E={$_.Properties[8].Value}}

Remediation

Block Password-Protected Archives: Configure email security gateways (ESGs) to quarantine or block password-protected ZIP and RAR files. While this may impact business workflow, the risk of malware delivery is currently too high.
User Awareness Training: Immediately notify users about the CERT-UA impersonation campaign. Instruct staff to verify the sender's actual email address (not just the display name) and to be suspicious of unsolicited password-protected attachments.
Endpoint Detection and Response (EDR): Ensure EDR sensors are up to date and actively monitoring for the SIGMA rules provided above. Quarantine any systems showing signs of AGEWHEEZE infection (e.g., unexpected C2 traffic or script execution from archives).
Isolate Infected Hosts: If a compromise is confirmed, isolate the affected machine from the network immediately to prevent lateral movement by the RAT.
Credential Reset: If AGEWHEEZE was executed, assume credential theft. Force a password reset for the affected user and any accounts accessed from that machine.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub