[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feXcMIp4gshdRfSHc3DFOsxR9Wdu01qSuugR0IcpGGgg":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":16,"technique_count":17,"created_at":18,"seoMetadata":19,"schemaOrg":23},"UAC-0154","uac-0154",[],"UAC-0154 is a threat actor orchestrating the STARK#VORTEX phishing campaign, specifically targeting Ukraine’s military. They employ a Microsoft Help file containing obfuscated JavaScript as a lure, disguised as a manual for Pilot-in-Command Drones, to deliver the MerlinAgent malware. This PowerShell-based RAT is heavily obfuscated and downloads a payload from a remote server, enabling full control over compromised systems. The group initially targeted Ukrainian entities using military-themed documents sent via email to @ukr.net addresses.",null,[],[],[],[15],"https:\u002F\u002Fwww.securonix.com\u002Fblog\u002Fsecuronix-threat-labs-monthly-intelligence-insights-september-2023\u002F",[],0,"2024-09-20T01:15:03.546468+00:00",{"title":20,"metaDescription":21,"keywords":22},"UAC-0154 Threat Actor Profile | EdgeProtect","UAC-0154 is a threat actor orchestrating the STARK#VORTEX phishing campaign, specifically targeting Ukraine’s military. They employ a Microsoft Help f...","UAC-0154, threat actor, APT, cyber threat, threat intelligence",{"@context":24,"@type":25,"name":6,"alternateName":26,"description":9,"url":27,"mainEntityOfPage":28},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fuac-0154",{"@type":29,"@id":27},"WebPage"]