Vulnerabilities & Alerts

UAC-0239 Conducts Cyberattacks in Ukraine Using the OrcaC2 Framework and FILEMESS Stealer

by  • 

Since the second half of September 2025, the National Cybersecurity Response Team of Ukraine (CERT-UA) has observed a new wave of targeted cyberattacks against Ukrainian defense forces and local government institutions.
These attacks have been attributed to the UAC-0239 group, believed to be operating on behalf of or in cooperation with Russian threat actors.

The attackers use social engineering themes related to “countering Russian sabotage and reconnaissance groups,” impersonating the Security Service of Ukraine (SBU) to gain trust.
Fraudulent emails contain links or attachments masquerading as official documents issued by the SBU.

Initial Infection Vector

The malicious campaigns rely on emails sent from Ukr.net and Gmail accounts.
These messages include:

  • a link to an archive file (sometimes password-protected), or
  • a direct attachment in VHD format (Virtual Hard Drive).

When the VHD file is opened, it typically contains:

  • a malicious executable, and
  • several decoy documents, usually PDF files mimicking SBU notices or directives.

Once executed, the malware initiates a multi-stage infection chain leading to data exfiltration and remote control of the compromised host.

Tools Used: OrcaC2 and FILEMESS

OrcaC2 Command & Control Framework

OrcaC2 is an open-source command-and-control (C2) framework written in Go, available on GitHub.
Although originally developed for legitimate cybersecurity research, it has been weaponized by UAC-0239 for malicious purposes.

Observed capabilities include:

  • remote command execution;
  • interactive shell access;
  • file upload/download;
  • screen capture and keylogging;
  • process management and memory dumps;
  • UAC (User Account Control) bypass;
  • code injection into other processes;
  • multi-protocol communication (RUDP, TCP, QUIC, SSH, SMB, SOCKS, etc.);
  • tunneling, proxy configuration, and port scanning;
  • brute-force password attacks.

Persistence is achieved via:

  • scheduled tasks,
  • registry entries under the Run key, or
  • Windows services.

FILEMESS Stealer

FILEMESS is a file-stealing malware also developed in Go.
Its primary goal is to locate, collect, and exfiltrate sensitive files from the infected host.

Behavioral analysis shows:

  1. Recursive scanning of Desktop, Downloads, and Documents directories, as well as logical drives D–Z.
  2. Filtering files by extension: office documents (ODT, DOCX, XLSX, PDF), images (JPG, PNG, TIFF), archives (ZIP, RAR), and text files.
  3. Calculating an MD5 hash for each file.
  4. Exfiltrating collected data via the Telegram Bot API.

Telegram authentication tokens are XOR-encrypted and Base64-encoded.
Persistence is maintained by creating a registry entry in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Indicators of Compromise (IoCs)

Malicious Files

File NameTypeSHA-256Description
Звернення_начальника_УСБУ_в_Харкiвскiй_області_Куц_О_И.exeFILEMESS executable85e304af49dada022bbd6799c3cda1f2Go-based stealer
GoogleUpdate.exeOrca Puppet0028c3d0de0a982706cf61f62c3e92e6OrcaC2 agent
gupdate.vbsScripteb2c906f9d0605c97522420bcf986026Secondary downloader
Звернення.pdfDecoy document48665e539496ed859a216bea8bd32124Fake SBU communication

Network Infrastructure

Domain / IPFunctionNotes
ssu-gov[.]comPhishingFake SBU domain
promoukrnet[.]xyzFILEMESS C2TCP port 2264
sbufiles[.]cloudHostingMalicious PDFs and payloads
185[.]186.26.98OrcaC2 C2 serverActive control node
api.telegram[.]org/bot7437010550ExfiltrationTelegram bot used for data theft
paste.c-net[.]orgScript distributionHosts LeatherBlending and PasadenaDeepest payloads

Typical Infection Chain

An infection sequence observed on September 26, 2025, proceeded as follows:

  1. The victim receives a phishing email impersonating the SBU.
  2. The user downloads a VHD file from Google Drive or a spoofed SBU domain.
  3. The victim opens a PDF decoy document.
  4. A VBS script (gupdate.vbs) is executed through PowerShell.
  5. The script downloads and runs GoogleUpdate.exe (Orca Puppet).
  6. The infected system establishes C2 communication with promoukrnet[.]xyz or ssu-gov[.]com.
  7. FILEMESS exfiltrates local documents via Telegram API.

CERT-UA Security Recommendations

The Ukrainian CERT recommends the following mitigation steps:

  • Do not open or mount VHD files received via email.
  • Monitor network traffic for the listed domains and IP addresses.
  • Block outbound connections to identified IoCs.
  • Inspect affected hosts for the following files and registry keys: %PUBLIC%\Downloads\GoogleUpdate.exe %PUBLIC%\Downloads\gupdate.vbs HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  • Report incidents or suspicious activity to: incidents@cert.gov.ua.

Official Sources