Cybersecurity researchers at TrendAI say a Russia-aligned threat actor tracked as UAC-0099 has used a previously undocumented .NET malware family called ASHVEIN in attacks against Ukrainian government personnel. The reported malware combines remote access trojan and information-stealing capabilities, and the campaign appears to be focused on a specific public-sector target set rather than broad consumer distribution.

What happened

According to TrendAI, UAC-0099 deployed ASHVEIN in a campaign targeting Ukrainian government personnel. The company tracks the activity cluster under the name Earth Sirrush, previously SHADOW-EARTH-065.

The malware is described as a .NET-based infostealer and remote access trojan. TrendAI also said the attackers used techniques to hide commands in HTML, a method that can complicate detection and analysis. Based on the information available in the source, the attribution and technical assessment come from the security vendor and should be understood as threat intelligence reporting rather than a government statement.

Why it matters for European businesses

The immediate victims in the reported case are Ukrainian government personnel, but the underlying tradecraft is relevant more broadly across Europe. Attacks that combine credential theft, remote access and evasive command techniques can also be adapted for use against suppliers, NGOs, regulated industries and private companies.

For businesses, the main concern is not only this specific malware family but the broader pattern it represents:

• Credential theft and remote control: Malware that steals information and enables attacker access can lead to account compromise, internal espionage, fraud or follow-on ransomware activity.
• Evasion techniques: Hiding attacker instructions in apparently benign content such as HTML may reduce visibility for basic email and web security controls.
• Geopolitical spillover risk: Campaigns aimed at public institutions in Eastern Europe can create indirect risk for contractors, technology partners and organisations operating in the region.
• Need for layered defence: Signature-based antivirus alone may be insufficient when new malware families or obfuscation techniques are involved.

For European SMEs, this is a reminder that targeted intrusions are not limited to large enterprises. Smaller organisations connected to public-sector, defence-adjacent or cross-border operations can also become attractive entry points.

Who may be affected

• Public-sector suppliers and contractors working with government bodies
• Companies with operations, staff or partners in Ukraine or neighbouring European markets
• IT teams responsible for Microsoft and Windows-heavy environments where .NET malware may blend in more easily
• Organisations in regulated or sensitive sectors handling confidential communications or strategic information
• SMEs that rely heavily on email attachments, web content and endpoint devices without advanced monitoring

What companies should consider

Although the source describes a targeted campaign, European organisations can use the report as a prompt to review practical controls:

• Review phishing defences: Strengthen email filtering, attachment analysis and user awareness for spear-phishing scenarios.
• Improve endpoint visibility: Ensure endpoint detection and response tools can flag suspicious .NET execution, unusual child processes and unauthorised persistence activity.
• Inspect web and HTML-based delivery chains: Security teams should examine whether current controls can detect malicious content or hidden instructions delivered through HTML files or web traffic.
• Protect credentials: Enforce multi-factor authentication, reduce local admin rights and monitor for unusual login behaviour after endpoint compromise.
• Update threat monitoring: Track vendor advisories and relevant indicators of compromise if they become available from trusted security sources.
• Assess third-party exposure: Organisations supporting government, infrastructure or regional operations should review supplier and partner security posture as part of broader resilience planning.

At this stage, the report is most relevant as a threat-intelligence signal rather than evidence of a broad campaign against all European businesses. However, for organisations operating in higher-risk sectors or regions, the techniques described are a practical reminder to strengthen endpoint, identity and phishing defences.