What the File Is
The title “ANOTHER UAC-0010 STORY” reads like something filed by a researcher who has written enough of these reports to have a naming convention for them. The document was produced by the Cyber Incidents Response Operational Centre, a sub-unit of Ukraine’s State Cyber Protection Centre (SCPC), published in January 2023 with no day-precise date given. The classification level is TLP:CLEAR, meaning no access restrictions apply. A copy is held by the National Security Archive, a non-governmental research institution at George Washington University in Washington, D.C. No case or file number appears in the document.
How the Intrusion Was Built
On or around January 9, 2023, spear-phishing messages went out carrying RAR archive attachments. The archive name and the LNK shortcut inside both bore the date “09.01.2023” and referenced a Security Service of Ukraine request, lending the lure the appearance of official correspondence. Opening the LNK file silently called mshta.exe to retrieve a remote file named quicker.rtf, which was not an RTF document but an HTML Application containing obfuscated VBScript.
Two base64-encoded scripts were embedded in that file. The first established persistence through a scheduled task called “Lightworks Metadata,” configured to run every five minutes, and through a registry autorun key. The second handled communication with the attacker’s infrastructure. The chain extended through at least four sequential stages, deploying GammaLoad (a VBScript dropper that fetches the next stage from a remote server) and GammaSteel (a PowerShell script capable of reconnaissance and executing additional commands), with further scheduled tasks added at Stage 3 under the names “Notifications” and “WindowsActionDialog,” each set to execute every five minutes. The final stage delivered PowerShell payloads over HTTPS using TLS 1.2, with at least three functional variants analyzed.
The report describes the architecture as built specifically so that discovery of any individual component would not collapse the implant’s overall persistence.
Three Ways to Find the Server, and One Domain That Changed Sides
Rather than hardcoding server addresses, the malware retrieved command-and-control IP addresses through three parallel methods: WMI DNS queries against a malicious subdomain, Cloudflare’s public DNS-over-HTTPS service, and live parsing of posts from attacker-controlled Telegram channels. Channels and IP addresses were rotated periodically.
One domain’s timeline is documented in enough detail to be worth stating precisely. The domain secureurl[.]shop began resolving to an IP address on MivoCloud SRL’s infrastructure in the Republic of Moldova on January 1, 2023. On January 16, 2023, the same domain switched to IP address 193.29.204.56, attributed to the Security Service of Ukraine itself.
The SCPC analysts characterize this pattern, attaching malicious domains to IP space belonging to legitimate Ukrainian institutions, as what the report calls a systematic approach to complicating infrastructure analysis. The C2 URL was also configured to respond only to requests originating from Ukrainian IP address space, which the report notes as a further layer of access control.
The Attribution, as Stated
The report attributes the campaign to UAC-0010, the CERT-UA designation for the group also known as Gamaredon or Armageddon. Attribution is not presented as probable or suspected; the SCPC’s language treats it as confirmed, describing UAC-0010 as Russian-sponsored and one of the principal cyber threats facing Ukrainian organizations.
The reasoning, as stated by the analysts, rests on two behavioral observations: UAC-0010 deliberately reuses its malware tooling while incrementally modifying it to stay ahead of signature-based detection, and the multi-stage chain is built so that exposure of any single layer does not give defenders a path to the rest of the implant. Both are presented as the product of analysis across multiple documented campaigns, not this one alone.
oearps and siacmgkvy
Two Telegram channel identifiers appear in the report: oearps and siacmgkvy. The malware parsed live posts from these channels to retrieve updated command-and-control addresses, querying them in real time alongside the WMI and Cloudflare methods, making them an active operational component rather than passive artifacts. The report makes no identification of the operators behind those accounts, states no organizational role, and is silent on whether either channel was reported to Telegram or suspended. They appear as technical indicators and nothing further is said.
The Boundaries of the File
Three gaps in the record are worth naming. The identities and number of victim organizations are not disclosed anywhere in the document, which describes the campaign’s mechanics in considerable technical detail while making no statement about which networks received the phishing messages or how many were successfully compromised.
The record also makes no statement about whether any element of the described infrastructure was disrupted. Whether any domain, IP address, or Telegram channel was taken down or referred to a third party is not addressed.
The third gap is in the technical description itself. The source document, as held in the National Security Archive’s reading room, is truncated before the full detail of the Stage 4 PowerShell payload variants is provided. Whether the truncation results from OCR rendering, a deliberate omission, or the circumstances of archiving is not stated. The cause is unknown, and the record offers no indication either way.