In late March 2026, Ukraine’s national cyber defense team CERT-UA identified a targeted phishing campaign leveraging impersonation tactics to distribute malware under the guise of official cybersecurity guidance. The attack, observed between March 26–27, involved fraudulent emails posing as communications from CERT-UA, urging recipients to download a password-protected archive such as “CERT_UA_protection_tool.zip” or “protection_tool.zip” from the Files.fm platform. These emails targeted a broad spectrum of organizations, including government bodies, financial institutions, educational organizations, and IT companies.
The attackers reinforced credibility by deploying a spoofed website, cert-ua[.]tech, which mimicked the official CERT-UA portal. This site hosted instructions to download a so-called “protection tool,” further deceiving victims into executing malicious payloads. The delivered executable, internally labeled as /example.com/tvisor/agent, was identified as AGEWHEEZE, a Remote Access Trojan (RAT) written in Go.
Technical Characteristics of AGEWHEEZE
AGEWHEEZE demonstrates a wide range of capabilities typical of advanced RATs, enabling full remote control over compromised systems. Its functionality extends beyond basic command execution and file manipulation to include screen capture, keyboard and mouse emulation, clipboard interaction, and process management.
Persistence mechanisms include registry modifications, scheduled task creation, and placement within system directories such as:
%APPDATA%\SysSvc\SysSvc.exe%APPDATA%\service\service.exe
It establishes persistence through registry keys like:HKCU\Software\Microsoft\Windows\CurrentVersion\Run\'SvcHelper' and CoreService, alongside scheduled tasks of the same names.
Communication with the command-and-control (C2) infrastructure is conducted via WebSockets, specifically:
(wss)://54[.]36.237.92:8443
The C2 server is hosted on OVH infrastructure (AS16276). Notably, a web panel titled “The Cult” operates on port 8443, with Russian-language strings embedded in its HTML, hinting at the attacker’s operational context.
Infrastructure and Attribution Clues
The malicious domain cert-ua[.]tech was registered on March 27, 2026, and utilized a GlobalSign SSL certificate. Embedded within its HTML was a signature referencing a Telegram group:
“CYBER SERP – hXXps://t[.]me/CyberSerp_Official”
By March 28, this Telegram channel publicly claimed responsibility for the campaign, leading CERT-UA to assign the identifier UAC-0255 to track this threat actor activity.
Additional infrastructure indicators include:
hXXps://files[.]fm/u/7nxvfbmf46hXXps://files[.]fm/u/cmr9kspbs5hiddify.creepy[.]ltdpanel.creepy[.]ltd- Email:
[email protected]
Command Capabilities
AGEWHEEZE supports a structured command set enabling granular control. Some notable commands include:
0x11– ScreenControl0x21– InputKeyboard0x31– FileRead0x42– ProcKill0x50– SelfDelete0x64– CmdExec0x70– PowerAction0x90– ClipRead
This modular design indicates a flexible and extensible framework suitable for espionage and persistence-driven campaigns.
Impact Assessment
Despite the sophistication of the attack chain, CERT-UA reported limited success. Only a small number of personal devices, primarily within educational institutions, were compromised. Rapid detection and coordinated response helped mitigate broader damage.
Our Analysis and Opinion
This campaign highlights a growing trend where attackers combine social engineering with AI-assisted content generation to scale credibility and reach. The impersonation of a national cybersecurity authority is particularly concerning because it exploits institutional trust rather than technical vulnerabilities alone.
What stands out is the attacker’s effort to simulate legitimacy across multiple layers—email, website cloning, SSL certificates, and even Telegram attribution. This multi-channel deception reflects a shift toward psychological manipulation rather than purely technical exploitation.
However, the limited impact suggests that awareness and defensive maturity are improving. Organizations appear more cautious about executing unsolicited software, even when framed as security tools. This is a positive signal for cyber resilience.
From a defensive standpoint, the recommendation to reduce attack surface using tools like SRP and AppLocker is critical but often underutilized. Endpoint hardening, combined with strict execution policies, could have completely neutralized this attack vector.
Ultimately, this case reinforces a key lesson: trust must always be verified, even when the source appears authoritative. As threat actors increasingly weaponize trust and automation, organizations must invest equally in user awareness and technical controls to stay ahead.
