From clinics to government: UAC-0247 expands cyber campaign across Ukraine
Overview
CERT-UA has reported a significant cyber campaign by the threat actor known as UAC-0247, targeting Ukrainian clinics and government bodies. This operation, which took place between March and April 2026, involved the use of malware designed to steal sensitive data from Chromium browsers and WhatsApp. The affected entities include municipal healthcare facilities, such as emergency hospitals and clinics, which are critical for public health. This cyber attack not only threatens the privacy of individuals seeking medical care but also poses risks to the operational integrity of essential services in Ukraine. As the conflict in Ukraine continues, the expansion of such cyber operations raises alarms about the security of public institutions and personal data in the region.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: UAC-0247 malware targeting Chromium browsers and WhatsApp, affecting Ukrainian clinics and government entities.
- Action Required: Organizations should enhance their cybersecurity protocols, including regular updates to software, monitoring for unusual activities, and educating staff about phishing and malware threats.
- Timeline: Ongoing since March 2026
Original Article Summary
CERT-UA reports UAC-0247 targeting Ukrainian clinics and government bodies with malware stealing data from Chromium browsers and WhatsApp. CERT-UA has revealed a cyber campaign by the threat actor UAC-0247 targeting Ukrainian government entities and municipal healthcare facilities, including clinics and emergency hospitals. The operation between March and April 2026, used malware designed to steal sensitive […]
Impact
UAC-0247 malware targeting Chromium browsers and WhatsApp, affecting Ukrainian clinics and government entities.
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since March 2026
Remediation
Organizations should enhance their cybersecurity protocols, including regular updates to software, monitoring for unusual activities, and educating staff about phishing and malware threats.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Malware, Critical.