Security2 hOctober 18, 2026, 13:25

ASHVEIN hides C2 tasking in invisible HTML elements

TrendAI has uncovered ASHVEIN, a .NET infostealer and RAT attributed to Russia-aligned group UAC-0099 (Earth Sirrush), used against Ukrainian government personnel. The malware hides command tasking inside invisible HTML elements, steals credentials from Chrome and Firefox, and captures screenshots via GDI.

DEV Community

Open source

ASHVEIN hides C2 tasking in invisible HTML elements

Five ASHVEIN builds were compiled between October 8 and 23, 2025, in three packing variants
Capabilities include credential theft, GDI screenshots, file collection, PowerShell shell and encrypted C2
Some variants use GitHub as a fallback dead drop resolver
ESET links UAC-0099 to an initial access broker role for Sandworm

#TrendAI#UAC-0099#Sandworm#ESET

UAC-0099 Targets Ukrainian Government Staff With ASHVEIN RAT

Security

UAC-0099 hides nuclear-weapons prompt in malware to make AI analysis refuse it

Security

ESET details MATCHBOIL: UAC-0099 malware installs spying backdoor on Windows

Security

ASHVEIN hides C2 tasking in invisible HTML elements

UAC-0099 Targets Ukrainian Government Staff With ASHVEIN RAT

UAC-0099 hides nuclear-weapons prompt in malware to make AI analysis refuse it

ESET details MATCHBOIL: UAC-0099 malware installs spying backdoor on Windows

TrendAI launches autonomous AI-driven vulnerability discovery service