A Russia-aligned threat actor known as UAC-0050 (also called DaVinci Group or Mercenary Akula) has expanded its operations beyond Ukraine to target a European financial institution involved in regional reconstruction. 

Campaign Details

• Attack Vector: The group utilized spear-phishing emails that spoofed a Ukrainian judicial domain to appear legitimate. These emails targeted a senior legal and policy advisor within the institution to gain privileged insight into procurement and financial operations.
• Malware Payload: The primary payload delivered was the Remote Manipulator System (RMS), a legitimate Russian remote desktop tool. This “living-off-the-land” strategy allows for persistent, stealthy access while evading traditional antivirus detection.
• Infection Chain: The attack used a multi-layered approach involving a ZIP archive that contained a password-protected 7-Zip file. Inside was an executable using the double extension trick (.pdf.exe) to trick the user into executing the MSI installer for RMS.
• Infrastructure: Malicious archives were hosted on PixelDrain, a file-sharing service frequently used by the group to bypass reputation-based security controls. 

Threat Actor Profile

UAC-0050 is characterized as a mercenary group associated with Russian interests. Their activity typically spans three key areas: 

1. Cyber Espionage: Gathering intelligence from government and financial sectors.
2. Financial Theft: Forming fake payments through remote banking systems.
3. Information Operations: Conducting psychological operations (PSYOPs) under the Fire Cells Group brand.