UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

The Russia-aligned threat actor UAC-0099, also tracked as Earth Sirrush, has been attributed to a newly discovered malware family called ASHVEIN. ASHVEIN is a .NET-based infostealer and remote access trojan (RAT) that conceals commands within HTML content. The malware has been deployed in targeted attacks against Ukrainian government personnel. The campaign was identified and analyzed by TrendAI, which previously tracked the cluster under the name SHADOW-EARTH-065. ASHVEIN represents a previously undocumented toolset associated with UAC-0099 operations. The use of HTML-based command hiding suggests an effort to evade detection by security tools. This activity aligns with broader Russian cyber operations targeting Ukrainian government infrastructure during the ongoing conflict.