UAC-0247 Targets Ukrainian Clinics and Government in Data-Theft Malware Campaign

The Hacker News

April 16, 2026 at 6:20 AM

Actively Exploited

Overview

Ukraine's Computer Emergencies Response Team (CERT-UA) has reported a new malware campaign targeting government and healthcare institutions, particularly clinics and emergency hospitals. This campaign, which took place between March and April, focuses on stealing sensitive data from users of Chromium-based web browsers and WhatsApp. The attackers are believed to be exploiting vulnerabilities to deliver this data-theft malware, raising concerns about the security of critical health information and government data. With healthcare systems already strained, this type of cyberattack poses significant risks not only to patient privacy but also to the overall functioning of essential services in Ukraine. The ongoing conflict and instability in the region make this situation particularly alarming, as attackers may aim to cause further disruption.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Chromium-based web browsers, WhatsApp
Action Required: Organizations should enhance their cybersecurity protocols, monitor for unusual activity, and ensure that all software is up to date.
Timeline: Ongoing since March-April 2023

Original Article Summary

The Computer Emergencies Response Team of Ukraine (CERT-UA) has disclosed details of a new campaign that has targeted governments and municipal healthcare institutions, mainly clinics and emergency hospitals, to deliver malware capable of stealing sensitive data from Chromium-based web browsers and WhatsApp. The activity, which was observed between March and April

Impact

Chromium-based web browsers, WhatsApp

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since March-April 2023

Remediation

Organizations should enhance their cybersecurity protocols, monitor for unusual activity, and ensure that all software is up to date. Users should be cautious about suspicious links and downloads.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Critical.

Read Original Article

Related Coverage

$13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims

The Hacker News

Grinex, a cryptocurrency exchange based in Kyrgyzstan and already sanctioned by the U.K. and U.S., has announced the suspension of its operations following a cyber attack that resulted in the theft of $13.74 million. The exchange claims this attack was orchestrated by foreign intelligence agencies, suggesting a coordinated effort rather than a random act of cybercrime. This incident raises concerns not only for Grinex but also for the broader cryptocurrency market, as it highlights vulnerabilities within exchanges, especially those already under scrutiny. The attack's implications could deter users from engaging with platforms that have been targeted, thereby affecting market confidence. As the investigation unfolds, the exchange and its users are left grappling with the fallout from this significant breach.

Apr 18, 2026

Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack TBK DVRs for DDoS Botnet

The Hacker News

Researchers from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 have identified that attackers are exploiting a command injection vulnerability, CVE-2024-3721, in TBK DVRs and outdated TP-Link Wi-Fi routers. This medium-severity flaw, which has a CVSS score of 6.3, allows malicious actors to hijack these devices to create a botnet for DDoS attacks. The compromised TBK DVRs and EoL TP-Link routers are particularly concerning as they can be easily targeted due to their lack of ongoing support and security updates. This situation poses a significant risk to users, as their devices can be turned into tools for larger-scale cyberattacks without their knowledge. Users of these devices should take immediate action to secure their systems against potential exploitation.

Apr 18, 2026

US imposes extended jail time on North Korean laptop farm facilitators

SCM feed for Latest

Kejia Wang and Zhenxing Wang, two residents of New Jersey, have been sentenced to nine years and nearly eight years in prison, respectively, for their roles in facilitating a North Korean laptop farm. This operation was part of a scheme that falsely represented IT workers, generating over $5 million for the North Korean regime. The laptop farm was used to support various illicit activities, highlighting the ongoing challenges posed by cyber operations linked to North Korea. The U.S. Department of Justice's actions aim to disrupt these types of operations and send a clear message against aiding sanctioned regimes. This incident serves as a reminder of the global reach of cybercrime and the importance of international cooperation in combating it.

Apr 17, 2026

Another PoC exploit released by 'BlueHammer' leaker after Microsoft dispute

SCM feed for Latest

A security researcher known as Chaotic Eclipse has released a proof-of-concept (PoC) exploit for a zero-day vulnerability in Microsoft Defender, identified as 'RedSun'. This follows the earlier disclosure of an exploit for another flaw in Defender, tracked as CVE-2026-33825, known as the BlueHammer flaw. The implications of these exploits are significant, as they expose users of Microsoft Defender to potential attacks that could compromise system security. Organizations using this antivirus solution should be particularly vigilant, as the release of these exploits could lead to increased attempts at exploitation by malicious actors. It's crucial for users to stay informed about updates from Microsoft regarding these vulnerabilities.

Apr 17, 2026

Ransomware attacks against automotive sector escalate

SCM feed for Latest

According to Infosecurity Magazine, ransomware attacks on automotive manufacturers have surged dramatically, with incidents more than doubling from 2024 to 2025. This alarming trend signals a growing vulnerability within the automotive sector, which has increasingly integrated digital technologies into its operations. As attackers target these manufacturers, the potential for significant disruptions in production and supply chains rises, posing risks not only to the companies involved but also to consumers and the broader economy. The rise in ransomware incidents indicates a pressing need for the automotive industry to enhance its cybersecurity measures and prepare for potential attacks. Companies must prioritize protecting their systems to safeguard against these evolving threats.

Apr 17, 2026

Nascent PowMix botnet covertly compromises Czech workforce

SCM feed for Latest

The PowMix botnet has been quietly targeting the workforce in the Czech Republic since December, using randomized communication techniques to evade detection. This stealthy operation involves the botnet compromising systems to potentially gain unauthorized access to sensitive information or resources. Researchers at The Hacker News have reported on the campaign, emphasizing the risk it poses to businesses and organizations in the region. As the botnet continues its activities, it raises concerns about the security of the Czech workforce and the need for enhanced protective measures against such covert attacks. Organizations are urged to remain vigilant and adopt robust security practices to defend against this emerging threat.

Apr 17, 2026