Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025

Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities via Viber to deliver malicious ZIP archives, part of ongoing intelligence-gathering operations in 2025. The 360 Advanced Threat Research Institute observed a phishing campaign against Ukraine’s Verkhovna Rada, exploiting themes such as changes to military personnel records and denied pensions for those killed in action.

The operation uses two main first-stage infection methods—malicious LNK files and PowerShell scripts—with LNK attacks requiring two C2 requests to fetch the decoy and the malicious ZIP, while PowerShell deliveries require a single request. Once executed, the campaign deploys HijackLoader to load the Remcos RAT into the legitimate Chime.exe process, enabling remote control and data theft.

The report links the campaign to UAC-0184 with high confidence, noting the use of Viber mirrors its past abuse of messaging apps and its pattern of social‑engineering themes tied to Ukrainian government and military interests. The article was published on 5 January 2026.