The Computer Emergency Response Team of Ukraine (CERT-UA) has recorded a new wave of cyberattacks attributed to the UAC-0050 hacker group. According to the center, the attackers have targeted state institutions and are conducting a mass email distribution campaign with a single goal — to gain hidden remote access to the work computers of Ukrainian officials. The new wave of malicious messages was recorded on October 29, 2026, indicating an active and ongoing campaign rather than an isolated incident.
Attack Scheme: Emails on Behalf of a DTEK Accountant
Experts described the specific phishing mechanism: hackers send emails allegedly on behalf of an accountant from the DTEK Energo company, demanding urgent repayment of arrears for consumed electricity. This topic was chosen deliberately — it looks routine and "work-related," which increases the likelihood that the recipient will open the email and execute the embedded malicious command. The successful execution of this scheme results in the attacker gaining hidden remote access to the official's machine, and consequently to the institution's internal networks and data.
Why the Attack Is Particularly Dangerous Right Now
The campaign poses a special threat under current conditions: Ukraine's energy infrastructure is under constant enemy shelling, and stabilization and emergency power outages are being recorded across the country. In such an environment, an email about an "electricity debt" is perceived as particularly urgent and pressing. According to expert assessment, the attackers deliberately rely on the emotional reaction and distraction of recipients, who in a stress situation tend to act faster and pay less attention to the content of the email than to its "urgency."
State Service of Special Communications Recommendations
State Service of Special Communications specialists urge users to exercise extreme caution when processing emails demanding urgent debt repayment. The practical conclusion for public sector employees and the civic security principle boils down to one rule: any email demanding urgent debt payment, especially from "energy workers" or the "accounting department," requires independent verification through the company's official channels rather than via links and attachments from the email itself. Trust should be placed only in verified contacts, not in the format and tone of the message.
The UAC-0050 campaign fits into a broader context of ongoing cyber threats against Ukraine, where phishing under the guise of utilitarian and "everyday" topics remains one of the most massive and inexpensive tools for gaining access to state systems. For CERT-UA and the State Service of Special Communications, the priority remains not only identifying new attack waves but also promptly informing potential victims to reduce the success rate of phishing schemes.
