Ukraine Warns of New UAC‑0050 Phishing Wave Against State Bodies Using Fake DTEK Debt Emails
Ukraine’s cyber agency says the UAC‑0050 hacking group is sending government staff phishing emails posing as electricity debt notices from energy firm DTEK, hiding remote‑access software in attached files.
Ukraine’s cyber authorities are warning state employees to be wary of what looks like a routine power bill.
The State Service for Special Communications and Information Protection said the threat group tracked as UAC‑0050 is running a mass phishing campaign aimed at government institutions. Ukraine’s Computer Emergency Response Team, CERT‑UA, has issued a technical alert on the same operation and urged tighter vigilance in state networks.
According to those warnings, attackers are sending large numbers of emails that appear to come from DTEK, a major Ukrainian energy company. The messages claim the recipient has an outstanding electricity debt and needs to review attached documents. Instead of genuine billing files, the attachments are malicious archives that lead victims through steps ending with installation of LiteManager, a legitimate remote‑administration tool.
Once LiteManager is quietly installed and configured to connect back to the attackers’ servers, UAC‑0050 can gain persistent remote access to the infected machine. That access could be used to steal documents, capture passwords, move deeper into official networks or deploy additional malware.
For officials already working under the strain of air raids and physical damage to infrastructure, an electricity debt notice is both believable and hard to ignore. The fear of losing power during wartime becomes an opening for espionage.
CERT‑UA’s description notes that the attackers’ use of common remote‑control software complicates defense. Traffic generated by LiteManager can resemble routine remote work, which may delay detection if organizations are not specifically monitoring for unexpected installations or connections.
Ukrainian agencies have faced repeated waves of hostile cyber activity since the start of full‑scale war, with intrusions often aimed at government, energy and communications targets. In this case, officials did not publicly attribute UAC‑0050’s campaign to any foreign sponsor in their alerts, but they treated the activity as significant enough to warrant a national warning.
For ministries and state companies, a single compromised workstation can serve as a bridge to more sensitive systems. Every successful intrusion forces security teams to divert time and money from upgrades to incident response and clean‑up, even as physical infrastructure is under attack.
The main questions now are whether any high‑value state systems have already been breached through this campaign, whether similar phishing waves appear against energy providers or local administrations, and how quickly Ukrainian defenders can tune their monitoring to spot misuse of tools like LiteManager inside their networks.
Sources
- OSINT