--- title: "Fake DTEK Electricity Debt Emails Turn Out to Be a Trap: CERT-UA Records New Cyberattack" description: "A new cyberattack has been recorded in Ukraine: hackers are sending emails on behalf of DTEK demanding the payment of an electricity debt. CERT-UA links the mailing to the UAC-0050 group." date: 2026-10-30T14:22:42.579Z lang: en url: https://xab.info/en/posts/fake-dtek-electricity-debt-emails-trap tags: [dtek, cyberattack, scam, ukraine, cert-ua, energy] author: "Alexander Buran" publisher: "XAB.info" --- # Fake DTEK Electricity Debt Emails Turn Out to Be a Trap: CERT-UA Records New Cyberattack ![Businesswoman in glasses using a laptop and checking documents at a kitchen table](https://xab.info/media/2026/10/30/pisma-o-dolgah-za-svet-ot-imeni-dtek-okazalis-lovushkoy/pisma-o-dolgah-za-svet-ot-imeni-dtek-okazalis-lovushkoy-1.webp) ## Key Points - Fraudsters are sending emails purportedly from a "DTEK Energy accountant" demanding the payment of an electricity debt. - The emails may contain dangerous links and files that give attackers access to the computer. - CERT-UA links the mailing to a cyberattack by the UAC-0050 group against state institutions; the wave of messages was recorded on October 29, 2026. - DTEK recommends checking debt only through official supplier channels (in Kyiv and Dnipropetrovsk Oblast via YASNO). A new wave of fraudulent mailings has been recorded in Ukraine, with attackers posing as employees of an energy company. According to RBC-Ukraine, citing statements by DTEK on Telegram and the State Service of Special Communications and Information Protection of Ukraine (SSSCIP) on Telegram, fraudsters are sending emails purportedly from a "DTEK Energy accountant" demanding the payment of an electricity debt. The company itself warned that such emails may contain malicious links and attachments: opening them gives the attackers access to the user's computer. Experts recorded the mass mailing of malicious messages on October 29, 2026. ### How the Scheme Works The attack scheme is designed so that the victim downloads and runs a program themselves, which opens up remote access to the device for hackers. According to SSSCIP, the mailing uses legitimate LiteManager software, which in this case is used by the attackers for covert remote computer management. That is why DTEK strongly recommends not opening attachments or clicking links in such emails, and checking information about debts exclusively through official channels of your electricity supplier — for example, in Kyiv and Dnipropetrovsk Oblast via the YASNO service. ### Why the Attack Is Dangerous Right Now SSSCIP noted that such a scheme is especially effective against the backdrop of Russian attacks on Ukraine's energy infrastructure and regular emergency and stabilization power outages. Under such conditions, messages about "electricity payment problems" look more convincing and increase the chance that the user will open the malicious email. Experts emphasize: the stronger the public anxiety surrounding energy supply, the higher the risk that people will act hastily and ignore basic safety precautions. ### Who Is Behind It Specialists from the government computer emergency response team CERT-UA linked the mailing to a new cyberattack by the UAC-0050 group targeting Ukrainian state institutions. According to the agency, hackers are mass-mailing emails to gain covert remote access to victims' computers. Thus, under the guise of an everyday topic — paying utility bills — the attackers are trying to infiltrate the information systems of government agencies. ### How to Protect Yourself DTEK and SSSCIP provide simple recommendations: do not open suspicious attachments and links, do not enter personal data, and do not click links in emails received from an "accountant" or "support service." Any information about debt should be checked only through official channels of the electricity supplier. If the email has already been opened and the attachment launched, you must immediately disconnect the device from the network and contact cybersecurity specialists. ### Other Active Fraud Schemes The mailing on behalf of DTEK is not the only active scheme. Earlier, RBC-Ukraine reported that fraudsters are hacking Telegram accounts under the guise of messages asking to vote for a child in a contest; several simple security setup steps help protect the account. Simultaneously, fraudsters are calling Ukrainians posing as the police, reporting the alleged detention of a relative or a criminal case against the person themselves and demanding money to "solve the issue." In all cases, the key protection remains verifying information through official sources and refusing to transfer money and data upon request from strangers. ## Fact-Check & Sources - [Письма о долгах за свет могут быть ловушкой: ДТЭК предупредил о мошенниках](https://www.rbc.ua/ukr/news/listi-borgi-svitlo-mozhut-buti-pastkoyu-dtek-1793369841.html) - Primary source: DTEK and SSSCIP statements on Telegram, malicious links/files, recommendation to check debt via official channels (YASNO), wave date — 29.10.2026, UAC-0050 group. - [Письма от ДТЭК могут оказаться ловушкой: в Украине зафиксировали новую кибератаку](https://fakty.com.ua/ru/ukraine/20261030-lysty-vid-dtek-mozhut-buty-pastkoyu-v-ukrayini-zafiksuvaly-novu-kiberataku/) - Confirms the UAC-0050 cyberattack on state institutions, the use of LiteManager for remote access, context of attacks on energy infrastructure; date 29.10.2026. ## FAQ ### On whose behalf are the fraudulent emails sent? Attackers pose as a "DTEK Energy accountant" and send emails demanding the payment of an electricity debt. ### What is dangerous about such emails? The emails may contain dangerous links and files; when opened, fraudsters gain access to the computer. According to SSSCIP, legitimate LiteManager software is used for remote access. ### How to check an electricity debt? Only through official channels of your electricity supplier. In Kyiv and Dnipropetrovsk Oblast — via the YASNO service. ### Who, according to CERT-UA, is behind the attack? The cyberattack is associated with the UAC-0050 group, targeting state institutions; the wave of malicious messages was recorded on October 29, 2026.