UAC-0194: Inside a Rapidly Evolving NTLM-Exploiting Espionage Operation

UAC-0194 is a threat group tracked by CERT-UA and believed to be linked to Russian actors. It appears to target government, diplomatic and administrative bodies in Ukraine, Poland and Romania. It uses .url, .lnk and .library-ms files to expose NTLMv2 hashes.

It exploited the NTLM flaws CVE-2024-43451 and later CVE-2025-24054. With them it moved from credential theft to long-term intelligence collection.

UAC-0194 has become an immediate priority for anyone tracking Windows Authentication (WinAuth) weaknesses. This is especially true for Eastern European phishing attacks that abuse NTLM credential authentication. This espionage operation has run long enough to show that UAC-0194 knows how to weaponize NTLM. It turns ordinary, legitimate files into malicious ones. It also moves from credential theft to long-term monitoring and intelligence collection on its targets.

This article gives a complete and timely assessment of UAC-0194. It covers the group’s operational methods, its motivations and the expected impact of its campaigns through 2025.

Introduction: A Threat Actor Built Around Subtlety and Precision

UAC-0194 is known for a calculated and precise approach to gathering information, rather than disruptive or attention-grabbing methods. The group’s trademark is its ability to produce NTLMv2 hashes from targeted documents with minimal user interaction. This gives it a considerable advantage over traditional ways of gaining access.

Unlike financially motivated threats, UAC-0194 shows traits usually linked to long-term intelligence collection. Its targeting, its pace and the vulnerabilities it exploits suggest a specific interest in government, diplomatic, and administrative infrastructure in Ukraine, Poland, and Romania. It moved quickly from one NTLM disclosure to another. This points to an exceptionally sophisticated development cycle for a regional espionage group.

Who is UAC-0194 and what does it want?

Identifying the motivation behind regionally focused espionage actors is challenging because little information is available. However, a growing body of intelligence shows a significant link to Russian actors. This rests on the choice of victims and on the infrastructure used by the actors and their past links to affected infrastructure. Evidence from CERT-UA’s UAC-0194 tracking also suggests the group has kept a continuous presence in operations against Ukrainian organizations.

The group’s goals appear to include:

• Establishing an initial position within government and public institutions.
• Obtaining NTLMv2 hashes that allow the group to perform offline cracking or to replay operations.
• Maximizing access to high-value sensitive communications.
• Establishing a foothold to perform additional espionage operations via lightweight remote access methods.

The operational model for UAC-0194 does not utilize complicated malware families as do many of its counterparts. Instead, they primarily gain advantages through authentication, which allows for diminished artifacts and present less opportunity for detection when committing their operations.

How does UAC-0194 attack?

Most of UAC-0194’s attack patterns may look uncomplicated at first. Behind them, however, is a carefully built operational workflow. It was developed to exploit authentication behavior in Windows, evade authentication logs and keep up the operational tempo.

Initial Access: Weaponized Shortcuts and Controlled Infrastructure

Phishing emails commonly impersonate legitimate Ukrainian Government Email Servers; in many instances, these emails do truly originate from legitimate Government mail servers. Previous compromises of Public Sector Mail Boxes provide the attacker the opportunity to send lures that appear authentic to the Government recipients.

Typical malware uses bulk e-mailing of macro-enabled spreadsheet files or trojanized installer executables as its main attachment type. UAC-0194 differs from this. Its delivery method uses .url, .lnk, and .library-ms files.

When a user previews or opens these file types, the user’s system may send automatic outgoing authentication requests (NTLM hashes). This exposes NTLM hashes to attacker-controlled infrastructure.

Pros:

• Requires very little User Interaction
• Makes Minimal Modifications to the Target System
• Provides Users with Valuable Authentication Information for Replay.

Persistence: Lean, Practical, and Deceptively Simple

Once inside, UAC-0194 does not utilize elaborate Infrastructure Persistence Frameworks. Instead, the UAC-0194 group is focused on:

• Reusing stolen NTLM hashes
• Using SparkRAT or similar open-source tools when a stable access point is needed
• Creating lightweight scheduled tasks as needed to obtain and rebuild footholds

These lean, practical and deceptively simple methods allow UAC-0194 to leave minimal forensic residue at the target. This maximizes the success of its espionage objectives.

C2 and Internal Operations: Blending With Normal Traffic

UAC‑0194 prefers to host payloads in the cloud. It redirects commands through a network that hides where the commands really come from, and it uses encrypted communication channels over standard web protocols. This helps its communications blend with the background noise of modern enterprise networks.

What operations has UAC-0194 run?

The UAC‑0194 operations have evolved rapidly since their inception.

Late 2024: The CVE‑2024‑43451 Zero‑Day

The first public revelation about the activity of the UAC‑0194 group was related to the exploitation of a zero‑day vulnerability associated with an NTLM disclosure. As part of this attack, the UAC‑0194 group used .library‑ms files that would trigger remote file loading through NTLMv2 authentication. This was primarily focused on targeting Ukrainian government institutions.

Early 2025: Transition to CVE‑2025‑24054

Soon after Microsoft released patch updates for the NTLM vulnerability, UAC‑0194 used a new but equally vulnerable NTLM disclosure method that resembled the first attack. These campaigns then expanded successfully into Poland and Romania. This reveals UAC‑0194’s broader geopolitical aspirations.

Continuing Activity: Credential Replay and Remote Access Deployment

The goal of this ongoing effort continues to be hash harvesting. In several observed breaches, the threat actor first used SparkRAT to establish a foothold or gain remote access for hash harvesting. It then appears to have used the same tool for further reconnaissance or internal data access.

Recent Developments: A Threat Growing in Precision and Pace

The significant aspect of UAC‑0194 is its high operational tempo (the number of breaches), in addition to its technical capability. Some characteristics of UAC‑0194 include:

• Rapidly exploiting new NTLM-related vulnerabilities
• Using regional intelligence to pick its targets
• Creating more sophisticated phishing lures tailored to governmental agency workflows
• Making greater use of open-source tools to reduce the risk of attribution

This combination of factors indicates that UAC‑0194 is evolving as a threat and displays the capability to modify its techniques with little to no downtime.

Conclusion

Implications for 2025 and Defensive Recommendations

UAC-0194’s approach shows that NTLM-related authentication attacks are underestimated. It also shows that many public sector networks still rely on outdated security models.

The actor uses low-interaction lures, selective tools and regionally focused targeting. Together these align with long-term espionage rather than short-term opportunistic action.

Key Defensive Measures

Organizations (including Government and Critical Public Sector organizations) should:

• Move away from NTLM as quickly as possible, at every opportunity
• Require SMB signing on all servers and block all outbound NTLM authentication requests
• Disable processing of remote file paths in .url and .library-ms file types
• Use phishing-resistant multifactor authentication (MFA) at administrative interfaces
• Monitor for sudden authentication attempts to unusual domain names
• Audit mailboxes for signs of compromise that may have been used to distribute lures

UAC-0194 will continue to refine its techniques throughout 2025. It will focus more on manipulating authentication, stealthy reconnaissance, and penetrating regional government networks. Proactive security measures and closer scrutiny of file-based lures are needed to counter the continuously evolving threat from this fast-moving espionage group.

You can download and review the sheet for all the details!