CERT-UA warns UAC-0245 targets Ukraine with CABINETRAT backdoor

CERT-UA warns UAC-0245 targets Ukraine with CABINETRAT backdoor, describing a campaign spotted in September 2025 that uses malicious Excel XLL add-ins masquerading as tools such as “UBD Request[.]xll” and “recept_ruslana_nekitenko.xll” to load a PE executable via the Excel Add-in Manager’s exported function xlAutoOpen.

According to CERT-UA, the dropper files include a startup-folder payload and a “BasicExcelMath[.]xll” in %APPDATA% plus an Office[.]png, with the XLL modifying the Windows Registry to maintain persistence while Excel runs in hidden mode and the XLL executes CABINETRAT shellcode from the PNG.

The payload and shellcode perform anti-analysis checks, verifying at least two CPU cores, 3GB RAM, and the presence of several virtualization platforms, and they check that the user SID does not end with “500” and the PEB debug flag. CABINETRAT is a C-written tool that gathers OS and installed-program data, handles files, takes screenshots, and communicates with a C2 over TCP after probing ports 18700, 42831, 20046 and 33976.

The report notes that, while UAC-0245 is tracked separately from known UAC-0002 activity against critical Ukraine infrastructure, the new campaign demonstrates novel tactics, techniques and procedures.