CuraSec

tag: Uac-0099 · 2 items

Learn archived UAC-0099 Deploys ASHVEIN RAT Against Ukrainian Government Targets
2026-10-08 · The Hacker News · source ↗ #ukraine-apt#rat-malware#uac-0099
  • Engineer — Skip
  • SOC/IR — Learn: ASHVEIN is a newly documented .NET infostealer/RAT using HTML to conceal C2 commands — adds to actor-profile knowledge for UAC-0099, but no IOCs or ATT&CK mappings are published in this report to enable immediate detection or hunting work.
  • Leader — Skip
Plan archived UAC-0099 embeds LLM-disrupting prompts in malware to blind AI analysis
2026-09-01 · The Hacker News · source ↗ #adversarial-ai#malware-analysis#uac-0099
  • Engineer — Learn: GuardBreaker shows that AI-assisted malware scanning can be manipulated at the artifact level; no patch or config change is needed today, but engineers building AI-augmented security pipelines should understand this evasion class.
  • SOC/IR — Plan: Review any AI/LLM-assisted triage or malware-analysis workflows and add a mandatory human-review layer for suspected APT samples — do not treat LLM output as authoritative when analyzing artifacts from sophisticated actors.
  • Leader — Learn: Adversaries are now actively engineering around AI-assisted defenses; file this as context for future AI-tool procurement and policy decisions around over-reliance on LLM-based analysis in SOC operations.