UAC-0050 overlap in Ukrainian mail

Summary

A Ukrainian-language mailing dated 31 October 2024, written as though passing on paperwork or details the recipient had asked for. Each message carried a compressed HTML attachment; opening it produced a local page running the public fake-CAPTCHA lure. Pasting what the page supplied started a second script, which called on the Windows background transfer service to fetch and launch the payload. Proofpoint suspects that payload was Lucky Volunteer, an information stealer it has seen only rarely and last recorded in early 2023, dropped then by AresLoader in a TA579 operation. One oddity: the page stayed in English while the message body and the attachment names were Ukrainian. Proofpoint places the activity as overlapping with UAC-0050. Three addresses are published — two fetch URLs and one control endpoint.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

5 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.