AGEWHEEZE Delivery: When CERT-UA Becomes the Attack Vector

Just caught the latest report on the UAC-0255 campaign impersonating CERT-UA. It’s a textbook example of the trust chain being weaponized. On March 26-27, threat actors sent out emails masquerading as the Ukrainian CERT to distribute AGEWHEEZE, a fairly nasty RAT.

The delivery method is the real kicker here—password-protected ZIP archives. It’s an old trick, but it still works because it bypasses most email gateway sandbox detonations. The password is usually in the body text, so the user actively "unlocks" the malware. Since there isn't a CVE involved in the delivery mechanism (it's pure social engineering), we have to rely heavily on behavioral analytics on the endpoint.

I’ve thrown together a quick Sigma rule to catch the execution chain, assuming the dropper uses a PowerShell one-liner to unpack the payload, which is consistent with AGEWHEEZE’s observed behavior:

title: Potential AGEWHEEZE RAT Execution
status: experimental
description: Detects suspicious PowerShell execution patterns associated with UAC-0255 AGEWHEEZE dropper.
references:
    - https://thehackernews.com/2026/04/cert-ua-impersonation-campaign-spread.html
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\winword.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - ' -enc '
            - 'DownloadString'
            - 'IEX'
    condition: selection
level: high

Has anyone seen IOCs for the C2 infrastructure yet? I'm particularly interested if they are using standard HTTP/HTTPS or if they’ve moved to something more obfuscated like DNS tunneling.