Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government

The Russia-aligned threat actor known as UAC-0184 has been observed targeting Ukrainian military and government entities by leveraging the Viber messaging platform to deliver malicious ZIP archives. The attack chain involves Viber delivering ZIPs containing multiple Windows shortcut (LNK) files disguised as official Microsoft Word and Excel documents to trick recipients into opening them.

The LNK files act as a decoy while Hijack Loader is deployed in memory through a multi-stage process that uses DLL side-loading and module stomping to evade detection, with the loader then fetching a second ZIP archive from a remote server via PowerShell. The loader also checks for installed security software by calculating CRC32 hashes, establishes persistence via scheduled tasks, and covertly executes Remcos RAT by injecting it into chime.exe, enabling the attackers to manage the endpoint and steal data.

According to the 360 Threat Intelligence Center, the group has continued high-intensity intelligence gathering activities against Ukrainian military and government departments in 2025, and CERT-UA first documented the threat in early January 2024.