A recent phishing campaign has been uncovered by the Computer Emergency Response Team of Ukraine (CERT-UA), where the agency’s own identity was used to spread malware, specifically a remote administration tool known as AGEWHEEZE, to approximately 1 million email recipients.
The campaign, attributed to threat actors tracked as UAC-0255, involved sending emails on March 26 and 27, 2026, that impersonated CERT-UA, aiming to deceive recipients into downloading a password-protected ZIP archive containing the malicious software.
This tactic of impersonating a trusted cybersecurity entity like CERT-UA is particularly dangerous, as it exploits the trust that such organizations have built, making the phishing emails more convincing and increasing the likelihood of success for the attackers.
The use of AGEWHEEZE malware in this context highlights the evolving nature of cyber threats, where attackers continuously seek new ways to bypass security measures and gain unauthorized access to systems and data.
It is crucial for individuals and organizations to remain vigilant and employ robust security practices to protect against such sophisticated phishing campaigns, including verifying the authenticity of emails, especially those that request downloading attachments or clicking on links.
As cybersecurity threats continue to escalate, staying informed about the latest tactics and vulnerabilities, such as those associated with CVEs and specific malware like AGEWHEEZE, is key to bolstering defenses against these ever-evolving threats.
Source: Original Article
