CERT-UA Warns of HTA-Delivered C# Malware Attacks Using Court Summons Lures

Aug 06, 2025Ravie LakshmananCyber Espionage / Malware

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of cyber attacks carried out by a threat actor called UAC-0099 targeting government agencies, the defense forces, and enterprises of the defense-industrial complex in the country.

The attacks, which leverage phishing emails as an initial compromise vector, are used to deliver malware families like MATCHBOIL, MATCHWOK, and DRAGSTARE.

UAC-0099, first publicly documented by the agency in June 2023, has a history of targeting Ukrainian entities for espionage purposes. Prior attacks have been observed leveraging security flaws in WinRAR software (CVE-2023-38831, CVSS score: 7.8) to propagate a malware called LONEPAGE.

The latest infection chain involves using email lures related to court summons to entice recipients into clicking on links that are shortened using URL shortening services like Cuttly. These links, which are sent via UKR.NET email addresses, point to a double archive file containing an HTML Application (HTA) file.

The execution of the HTA payload triggers the launch of an obfuscated Visual Basic Script file that, in turn, creates a scheduled task for persistence and ultimately runs a loader named MATCHBOIL, a C#-based program that’s designed to drop additional malware on the host.

This includes a backdoor called MATCHWOK and a stealer named DRAGSTARE. Also written using the C# programming language, MATCHWOK is capable of executing PowerShell commands and passing the results of the execution to a remote server.

DRAGSTARE, on the other hand, is equipped to collect system information, data from web browsers, files matching a specific list of extensions (“.docx”, “.doc”, “.xls”, “.txt”, “.ovpn”, “.rdp”, “.txt”, and “.pdf”) from the “Desktop”, “Documents”, “Downloads” folders, screenshots, and running PowerShell commands received from an attacker-controlled server.

The disclosure comes a little over a month after ESET published a detailed report cataloging Gamaredon’s “relentless” spear-phishing attacks against Ukrainian entities in 2024, detailing its use of six new malware tools that are engineered for stealth, persistence, and lateral movement –

• PteroDespair, a PowerShell reconnaissance tool to collect diagnostic data on previously deployed malware
• PteroTickle, a PowerShell weaponizer that targets Python applications converted into executables on fixed and removable drives to facilitate lateral movement by injecting code that likely serves PteroPSLoad or another PowerShell downloader
• PteroGraphin, a PowerShell tool to establish persistence using Microsoft Excel add-ins and scheduled tasks, as well as create an encrypted communication channel for payload delivery, through the Telegraph API
• PteroStew, a VBScript downloader similar to PteroSand and PteroRisk) that stores its code in alternate data streams associated with benign files on the victim’s system
• PteroQuark, a VBScript downloader introduced as a new component within the VBScript version of the PteroLNK weaponizer
• PteroBox, a PowerShell file stealer resembling PteroPSDoor but exfiltrating stolen files to Dropbox

“Gamaredon’s spearphishing activities significantly intensified during the second half of 2024,” security researcher Zoltán Rusnák said. “Campaigns typically lasted one to five consecutive days, with emails containing malicious archives (RAR, ZIP, 7z) or XHTML files employing HTML smuggling techniques.”

The attacks often result in the delivery of malicious HTA or LNK files that execute embedded VBScript downloaders such as PteroSand, along with distributing updated versions of its existing tools like PteroPSDoor, PteroLNK, PteroVDoor, and PteroPSLoad.

Other notable aspects of the Russian-aligned threat actor’s tradecraft include the use of fast-flux DNS techniques and the reliance on legitimate third-party services like Telegram, Telegraph, Codeberg, and Cloudflare tunnels to obfuscate its command-and-control (C2) infrastructure.

“Despite observable capacity limitations and abandoning older tools, Gamaredon remains a significant threat actor due to its continuous innovation, aggressive spearphishing campaigns, and persistent efforts to evade detections,” ESET said.

Upgrade your audio game with the Logitech for Creators Blue Yeti USB Microphone. With over 33,730 ratings and an impressive 4.6 out of 5 stars, it’s no wonder this is an Amazon’s Choice product. Recently, 5K+ units were purchased in the past month.

Available in five stunning colors: Teal, Silver, Pink Dawn, Midnight Blue, and Blackout, this microphone is perfect for creators looking to produce exceptional audio. Priced at only $84.99, it’s a deal you can’t afford to miss.

Elevate your recordings with clear broadcast-quality sound and explore your creativity with enhanced effects, advanced modulation, and HD audio samples. Order now for just $84.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!