Sandworm/UAC-0145: from fake Office and Signal lures to ClickFix and COWARDDUCK

A CyberDefence24 story about soldiers being targeted, Microsoft impersonation and Sandworm’s arsenal leads to a detailed CERT-UA report on UAC-0145, which the Ukrainian team describes as a UAC-0002 subcluster also known as Sandworm, APT44 and Seashell Blizzard. It documents several access paths: backdoored Windows and Office installers, “security” files sent over Signal, fake-CAPTCHA ClickFix and an Android application masquerading as a protection tool.

Chronology needs a clear correction. The CERT-UA report is dated 15 July 2026, and CyberDefence24 published on 17 July. This is a technical analysis released on 29 August at a reader’s request, not a claim that a new attack happened today. CyberDefence24 describes the group as linked to Russia’s GRU; CERT-UA retains its own cluster naming. Attribution conveys who sources assess is behind an operation, while defence should also rely on observable techniques.

The central lesson is not one malware family. UAC-0145 changes pretexts, platforms and command channels but repeatedly convinces a person or system to treat foreign code as trusted. Microsoft Office, “antivirus”, CAPTCHA, Signal, Dropbox, Steam and a DuckDuckGo proxy become credibility context or legitimate intermediary infrastructure.

Passive compromise: the user brings the backdoor inside

CERT-UA describes a long-running vector based on modified installers downloaded from torrent trackers, especially Windows and Microsoft Office. A backdoor was embedded in a product that the user was already looking for. The actor did not have to deliver a targeted document or exploit a browser; distributing an attractive pirated package was enough.

In at least one case, such a computer supported persistence and lateral movement inside an organisation. According to CERT-UA, this created conditions for a destructive operation against the infrastructure of a Ukrainian central executive authority. The distinction matters: downloading the installer provided initial access, while organisational damage followed from the host’s later network reach.

Hash checking only at installation time is insufficient without an approved source catalogue. Operating-system and office software should come from managed repositories, carry validated signatures and travel through a controlled deployment channel. Detection should cover not only known malware signatures but the appearance of any unapproved system or Office installer.

Signal: relationship building, pressure and fake protection

In another path, used especially but not exclusively against military personnel, the actor held extended Signal conversations. The target was told to install purported antivirus protection, and the attacker could offer money for following instructions. This is not seconds-long bulk phishing. A longer relationship can establish the target’s role, build credibility and tailor persuasion.

CERT-UA names KALAMBUR, SUMBUR and TAMBUR. Remote access also used legitimate OpenSSH and Tor to forward local ports — including 445, 3389 and 22 — to actor-controlled infrastructure. For detection, that behaviour matters more than a sample name: a host that suddenly publishes SMB, RDP or SSH through a persistent tunnel creates lateral-movement and remote-control paths without a custom C2 protocol.

The report also mentions tools stealing Signal and WhatsApp keys and data, with rsync potentially used for exfiltration. Messenger protection therefore cannot end at an account PIN. Defenders must protect the endpoint, key stores, linked-device list and data copies available on disk.

A separate May recommendation from Poland’s Government Plenipotentiary for Cybersecurity documents malware-free Signal account takeover: impersonating support, requesting an SMS code and PIN, or persuading a user to link a device with a QR code. Every such event should not automatically be attributed to UAC-0145, but the user control is shared: Signal Support does not message users inside the service, verification codes must remain private and linked devices need regular review.

ClickFix: a fake CAPTCHA launches a real command

During spring and summer 2026, CERT-UA observed infections beginning on websites that conditionally displayed a fake CAPTCHA. Its instructions asked the user to copy and run a PowerShell command. ClickFix avoids technical browser exploitation: the victim moves content outside the page sandbox and invokes it with a system interpreter.

One command wrote a VBS file to the Startup directory. A variant named GHETTOVIBE then executed at logon. The next stage could retrieve SCOUTCURL, a PowerShell script that collected system characteristics, installed applications, files and browser data. Reconnaissance let the actor assess a machine’s operational value before committing a heavier payload.

Chains also included FLUIDLEECH, disguised as a virus-removal tool, and LOADLOOP. Responders found FREAKYPOLL, a backdoor distributed as compiled Python .pyc bytecode. Each element uses a different trust signal: VBS resembles administration, PowerShell is built into Windows and compiled Python may appear to belong to a legitimate application.

SMARTAXE and a domain retrieved from a smart contract

CERT-UA analysed ClickFix on more than ten compromised websites. Some used Cloaking.House to filter visitors and conditionally present a remote page, iframe or redirect. A scanner, administrator and intended victim could therefore receive different content.

SMARTAXE added another layer. It retrieved a remote resource’s domain name from a smart contract through eth_call, using a contract address and function selector embedded in code. The domain could be changed away from the compromised website without modifying the same script. Blocking one hostname removes the current indicator but not the resolution mechanism for its replacement.

Defenders therefore need behavioural visibility: a page script making blockchain calls, dynamically creating an iframe or retrieving an external domain is a stronger lead than a static list. An administrator whose website appears in the campaign should treat it as compromised and find the cause — vulnerable CMS, stolen credentials, webshell, foreign plugin, modified script or persistent backdoor. Removing the CAPTCHA alone does not close the incident.

COWARDDUCK: the same pretext moves to Android

An APK sent to mobile targets also posed as a security tool. COWARDDUCK was a full backdoor, covertly collecting device details, contacts, files from common directories and real-time geolocation. Its target extensions included documents, archives, configuration and VPN files.

The malware used the Dropbox API to upload files. It obtained commands or data from objects such as images on legitimate services, including image domains and Steam Community identified by CERT-UA, with traffic potentially relayed through proxy.duckduckgo.com. Domain reputation is no longer a binary decision in this design. A legitimate host does not establish that an object, path or request sequence is legitimate.

Managed devices should block APK installation outside an approved store, use MDM or mobile-threat defence and inventory new applications, location permissions and bulk file access. High-risk personnel benefit from separating private and official devices and from a rapid reporting path whenever a contact proposes installation of “protection”.

What to detect on Windows and the network

Build behavioural correlations rather than relying only on indicators. A browser followed by PowerShell, wscript or cscript deserves investigation. A new VBS in Startup, a Python interpreter or .pyc in an unusual user directory, and OpenSSH or Tor launched by an unmanaged process are additional signals.

Enable PowerShell script and process command-line logging while restricting access because logs may contain secrets. Correlate persistent tunnels with local ports 445, 3389 and 22 at the firewall and EDR. Examine unusual rsync, new SSH keys, Tor service activity and connections to legitimate cloud services from processes without a history of using them.

The MITRE ATT&CK mapping is Breachroad’s analytical conclusion: the chain contains user execution, PowerShell, Startup Folder persistence, protocol tunnelling, system discovery and exfiltration over a web service. Detection works best when it combines at least two stages, because each one can have a legitimate explanation in isolation.

Responding to suspected infection

Isolate the host while preserving the ability to acquire evidence under the incident-response procedure. Examine Startup entries, PowerShell/VBS/Python child processes, tunnels, messenger keys and connection history. Revoke credentials only after establishing a clean device; changing a password from a still-compromised endpoint hands the new secret to the actor.

For Signal, remove unknown linked devices, enable Registration Lock and report the incident to the responsible team. For Android, do not stop at uninstalling the APK — assess session tokens, cloud accounts, VPN access, exposed documents and location history. For a website, rebuild from a trusted source, patch the entry point, rotate credentials and examine other tenants on the host.

Source facts and Breachroad conclusions

Tool names, access paths, OpenSSH/Tor use, ClickFix, the smart-contract mechanism and COWARDDUCK capabilities come from CERT-UA. The GRU and Polish-energy context comes from CyberDefence24. Correlation, device separation and rotation order are Breachroad’s defensive conclusions. Not every fake Signal-support incident is automatically a UAC-0145 operation; attribution needs additional evidence.

Sources

This campaign shows that a technically capable intrusion often starts with a credible story and a legitimate tool. Our cybersecurity and phishing-resilience training covers ClickFix, fake support and pressure to install software. High-risk organisations can also assess detection, segmentation and team readiness through incident-response exercises.