Threat Intelligence Report

Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading

📅 July 5, 2026 📰 blog.synapticsystems.de 🔍 1 CVE(s) referenced

UAC-0226 has significantly evolved its GIFTEDCROOK delivery chain, now leveraging NTFS Alternate Data Streams and reflective in-memory loading to stealthily plant persistent, multi-stage stealers targeting Ukrainian military personnel, while minimizing on-disk indicators and broadening its data theft capabilities.

unclassified

CVE-2025-8088

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle