CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails

This article covers a phishing campaign by threat actor UAC-0255 that impersonated Ukraine's CERT-UA to distribute the AGEWHEEZE remote access trojan.

• •Emails sent on March 26-27, 2026 posed as CERT-UA, delivering a password-protected ZIP archive hosted on Files.fm containing malware disguised as security software.
• •Targets included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies.
• •AGEWHEEZE is a Go-based RAT communicating via WebSockets, supporting command execution, file operations, clipboard modification, mouse/keyboard emulation, screenshot capture, and process management.
• •The malware establishes persistence through scheduled tasks, Windows Registry modifications, or Startup directory entries.