Russian Cyber Mischief: UAC-0125 Hijacks Cloudflare to Target Ukrainian Army
CERT-UA reports that the threat actor UAC-0125 is misusing Cloudflare Workers to target the Ukrainian army. Shrouded in digital deception, this malware masquerades as the Army+ app, proving once again that cyber actors have a flair for dramatic entrances—and exits.
Hot Take:
If cyberwarfare were a plot twist, this would be the moment when the villain uses someone else’s tech to wreak havoc. UAC-0125, with the subtlety of a bull in a china shop, is waltzing through Cloudflare Workers to drop malware on the Ukrainian Army. It’s like borrowing your neighbor’s lawnmower to dig a tunnel to China—unexpected, creative, and slightly illegal.
Key Points:
– UAC-0125, a Russia-linked threat actor, is exploiting Cloudflare Workers to target the Ukrainian military.
– Fake websites mimicking the Ukrainian Ministry of Defence’s “Army+” app are being used to distribute malware.
– The attack uses a Windows executable that includes a decoy file and a PowerShell script for covert access.
– UAC-0125 is connected to the notorious Sandworm/APT44 cybercriminal cluster.
– CERT-UA has provided cyber threat indicators to help counter this campaign.