UAC-0145 Uses ClickFix CAPTCHAs for Ukrainian Malware Attacks

Russian state-sponsored threat actors, identified as UAC-0145, have been observed employing a tactic known as ClickFix to compromise Ukrainian computer systems. This strategy involves presenting users with CAPTCHA challenges that, when incorrectly solved or bypassed, lead to the download of data-stealing malware. The Computer Emergency Response Team of Ukraine (CERT-UA) has attributed this activity to UAC-0145, which is understood to be a sub-cluster operating under Sandworm, an advanced hacking unit linked to Russia's Main Intelligence Directorate (GRU).

The ClickFix strategy exploits user interaction with CAPTCHA services, often by embedding malicious links or code within the CAPTCHA verification process. When users attempt to solve these CAPTCHAs, they inadvertently trigger the download or execution of malware. CERT-UA has issued alerts and advisories detailing the methods used by UAC-0145, emphasizing the need for increased vigilance among Ukrainian internet users and organizations. The primary objective of these attacks appears to be the exfiltration of sensitive data from compromised Ukrainian devices.

Sandworm is a well-documented Russian cyber-espionage and sabotage group known for its sophisticated operations targeting critical infrastructure and government entities. The involvement of a sub-cluster like UAC-0145 suggests a continued and evolving effort by Russian intelligence to conduct cyber operations against Ukraine. The use of ClickFix represents a specific, socially engineered approach designed to bypass traditional security measures by leveraging user trust and common online interactions. CERT-UA continues to monitor these activities and provide guidance on mitigation strategies to protect against such threats.