A new wave of fraudulent mailings has been recorded in Ukraine, with attackers posing as employees of an energy company. According to RBC-Ukraine, citing statements by DTEK on Telegram and the State Service of Special Communications and Information Protection of Ukraine (SSSCIP) on Telegram, fraudsters are sending emails purportedly from a "DTEK Energy accountant" demanding the payment of an electricity debt. The company itself warned that such emails may contain malicious links and attachments: opening them gives the attackers access to the user's computer. Experts recorded the mass mailing of malicious messages on October 29, 2026.
How the Scheme Works
The attack scheme is designed so that the victim downloads and runs a program themselves, which opens up remote access to the device for hackers. According to SSSCIP, the mailing uses legitimate LiteManager software, which in this case is used by the attackers for covert remote computer management. That is why DTEK strongly recommends not opening attachments or clicking links in such emails, and checking information about debts exclusively through official channels of your electricity supplier — for example, in Kyiv and Dnipropetrovsk Oblast via the YASNO service.
Why the Attack Is Dangerous Right Now
SSSCIP noted that such a scheme is especially effective against the backdrop of Russian attacks on Ukraine's energy infrastructure and regular emergency and stabilization power outages. Under such conditions, messages about "electricity payment problems" look more convincing and increase the chance that the user will open the malicious email. Experts emphasize: the stronger the public anxiety surrounding energy supply, the higher the risk that people will act hastily and ignore basic safety precautions.
Who Is Behind It
Specialists from the government computer emergency response team CERT-UA linked the mailing to a new cyberattack by the UAC-0050 group targeting Ukrainian state institutions. According to the agency, hackers are mass-mailing emails to gain covert remote access to victims' computers. Thus, under the guise of an everyday topic — paying utility bills — the attackers are trying to infiltrate the information systems of government agencies.
How to Protect Yourself
DTEK and SSSCIP provide simple recommendations: do not open suspicious attachments and links, do not enter personal data, and do not click links in emails received from an "accountant" or "support service." Any information about debt should be checked only through official channels of the electricity supplier. If the email has already been opened and the attachment launched, you must immediately disconnect the device from the network and contact cybersecurity specialists.
Other Active Fraud Schemes
The mailing on behalf of DTEK is not the only active scheme. Earlier, RBC-Ukraine reported that fraudsters are hacking Telegram accounts under the guise of messages asking to vote for a child in a contest; several simple security setup steps help protect the account. Simultaneously, fraudsters are calling Ukrainians posing as the police, reporting the alleged detention of a relative or a criminal case against the person themselves and demanding money to "solve the issue." In all cases, the key protection remains verifying information through official sources and refusing to transfer money and data upon request from strangers.
