kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · RU

Earth Sirrush

also tracked as uac 0099 2

2 stories · 2 in the wild · October 8, 2026 – October 11, 2026

evidence: 2 observed

how they got in

  • phishing email 1 · Oct 8

sectors

  • government 1 · Oct 11

geography

  • ukraine 1 · Oct 11

malware and tools

  • ashvein 1 · Oct 11

techniques

  • credential access 1 · Oct 11
  • dll sideloading 1 · Oct 11
  • command and control 1 · Oct 8
  • defense evasion 1 · Oct 8
  • execution 1 · Oct 8
  • persistence 1 · Oct 8

attack phases seen

  • Command and control 2 · Oct 11
  • Execution 2 · Oct 11
  • Collection 1 · Oct 11
  • Defense evasion 1 · Oct 8
  • Persistence 1 · Oct 8

what we reported, newest first, grouped by story

Oct 8 – October 11, 2026 · 2 reports

  • UAC-0099 has a previously undocumented .NET RAT. TrendAI attributes ASHVEIN (internally "TelemetryBrowser") to the Russia-aligned group it tracks as Earth Sirrush, used against Ukrainian government personnel. It steals Chrome and Firefox credentials, captures GDI screenshots, runs PowerShell remote shells, and hides tasking inside invisible HTML elements; some variants use a GitHub dead drop resolver as C2 fallback, with delivery via DLL sideloading, VHD containers and .NET droppers. ESET has previously described the group as an initial-access broker for Sandworm. The Hacker News · Oct 11 · observed · as uac 0099 · Threat Activity
  • UAC-0099 / Earth Sirrush embeds ZIP payloads inside PNG images, extracted via predefined markers, with spear-phishing for access, scheduled-task persistence, C2 tasking hidden in invisible HTML footer elements, sandbox checks and hybrid AES-RSA C2 encryption (technical brief). · Oct 8 · observed · via phishing email · as uac 0099 · Threat Activity