ASHVEIN 將 C2 任務指令藏於不可見 HTML 元素中

ASHVEIN, a previously undocumented .NET infostealer and remote access trojan, hides its command tasking inside invisible HTML elements. TrendAI attributes it to UAC-0099, the Russia-aligned group it tracks as Earth Sirrush (formerly SHADOW-EARTH-065), and reports it in attacks against Ukrainian government personnel.

Its developers call it "TelemetryBrowser." The capability set is standard espionage kit: credential theft from Chrome and Firefox, GDI-based screenshot capture, file enumeration and retrieval, PowerShell remote shell execution, system fingerprinting, and encrypted C2. The notable part is where the instructions live. Instead of carrying commands in an obvious protocol field, ASHVEIN embeds them in HTML elements that render to nothing. The traffic looks like a web page, and a defender inspecting it sees markup rather than a task queue. Some variants add a GitHub-based dead drop resolver as a fallback, so if the primary channel goes down the implant can still locate its controller.

Hiding C2 inside content that passes for ordinary web traffic is not a new idea, but it works well against controls keyed to recognizable command structure. Signature and heuristic detection that matches on request shape has little to grab onto here. The useful signal for hunting ASHVEIN is behavioral: the process issuing the requests, the GDI screenshot calls, the reads against browser credential stores. The content of the C2 responses will not give it away.

UAC-0099 has several ways in. TrendAI lists DLL sideloading (which it calls FORGECLAMP), VHD containers, and purpose-built .NET droppers. One dropper, AnswerFromPolice, embeds a Microsoft Word document posing as a response from the National Police of Ukraine. It displays that decoy while installing the malware in the background, pairing institutional impersonation with plausible content to get the target to open and trust the file.

The build data points to active development. Five ASHVEIN builds were compiled between October 8 and 23, 2025, across three packing variants. TrendAI notes functional overlap with DRAGSTARE (aka NordDragonScan): credential theft, screenshots, file collection, WMI fingerprinting. The two differ in origin. DRAGSTARE was compiled by the NordDragon developer account and includes anti-VM checks and subnet scanning; ASHVEIN came from a different account with a different packing approach. TrendAI reads the shared functionality plus separate build environments as parallel tool development under different developer accounts serving the same operational requirement.

That cadence fits the group's history. CERT-UA first documented UAC-0099 in June 2023, and it has hit Ukrainian government, defense, border guard, and logistics targets since at least mid-2022. Over that span it moved off PowerShell and Go tooling toward compiled C# and .NET Reactor-protected binaries tucked inside steganographic images. ESET, in its November 2025 APT Activity Report, says the group can act as an initial access broker for Sandworm, the Russian APT known for destructive attacks on Ukraine.

The group's downloader, MATCHBOIL, carries a sandbox check worth copying into your own threat model. ESET traces it to at least April 2024, and recent samples abort if the operating system's installation date is 10 or more days older than the execution date. The logic assumes a real victim machine has been in use for a while, and that an analysis sandbox is freshly provisioned. If you run malware detonation infrastructure, aging your images, or at least backdating the install timestamp, defeats this particular check.

ESET also caught a stranger experiment. A VBScript acting as a conduit for MATCHBOIL embedded a prompt asking for instructions to build a nuclear weapon, planted to trip an LLM's safety filter and stop an AI-assisted reviewer from reading the rest of the code. ESET's Fernando Tavella told The Hacker News the group has since dropped the tactic before malware deployment, so it reads as a short-lived test rather than standard practice. It is an early, crude instance of malware authored with automated analysis in mind, and the assumption behind it, that a model will refuse the whole file over one poisoned string, is worth keeping in view as more review pipelines route samples through LLMs.

TrendAI's last point is about who is being hit. Available evidence suggests targeting has widened past government and military to civilian logistics and infrastructure operators that keep Ukraine supplied, tracking the value of those networks as the war continues.