CERT-UA: UAC-0145 (Sandworm) runs ClickFix on Ukraine

Here’s what changed today: CERT-UA published alert 6318437 attributing a June–July 2026 ClickFix campaign against Ukrainian users to UAC-0145, which CERT-UA and The Hacker News’ writeup both describe as a sub-cluster within Sandworm — the GRU-affiliated unit better known outside CERT-UA’s own catalogue as APT44 / Voodoo Bear. Confidence: as-reported by CERT-UA, which named ten or more compromised websites as the delivery surface.

I’ll be honest — the interesting part isn’t that Sandworm is running ClickFix. It’s that ClickFix is now the shared plumbing under enough distinct clusters that the tactic itself is what you should be defending against, not any one family’s IOCs.

What CERT-UA says the operation looks like

At the class level: compromised legitimate Ukrainian sites serve a fake CAPTCHA that talks a visitor into pasting a command into a Run dialog or terminal. If they run it, the box is theirs. That is the entire ClickFix pattern — we’ve written about it here for TELEPUZ (April onward, likely MaaS), for ClickLock on macOS last week, and it’s the same delivery envelope Microsoft flagged in the ACR Stealer surge yesterday.

Two operational specifics from the CERT-UA writeup are worth pinning:

• The lure pages are served through SMARTAXE, described as a bespoke tool that rewrites the CAPTCHA page per visitor, and routed through Cloaking.House for traffic filtering — so what a researcher sees on the compromised page is not what the target sees.
• Domain names for the second-stage infrastructure are pulled via EtherHiding, i.e. read out of Ethereum smart contracts at run time. The same technique appeared in the ACR Stealer campaign Microsoft attributed to Storm-0408 earlier this week. Taking down a domain does not take down the pointer.

The payload set CERT-UA names

Six families, split by role:

• GHETTOVIBE — a VBS file dropped into the user’s Startup autorun directory for persistence.
• SCOUTCURL — a PowerShell script that performs basic host reconnaissance.
• FLUIDLEECH — a loader masqueraded as an antivirus removal utility.
• LOADLOOP — a second loader.
• FREAKYPOLL — a Python backdoor.
• COWARDDUCK — a full-featured Android backdoor, delivered as APK via messaging apps, harvesting contacts, real-time geolocation, and files matching a targeted extension list — .conf, .json, .ovpn, .txt, .doc(x), .xls(x), .pptx, .zip, .rar. Exfil rides Dropbox’s API; some tasking is fetched from external servers or benign-looking sites, steamcommunity[.]com explicitly cited.

The .ovpn and .conf inclusion in COWARDDUCK’s target list tells you what this cluster is actually after: VPN config files that let the operator step onto Ukrainian networks with legitimate credentials instead of exploits.

What to actually do

There’s no fresh CVE to chase here, which is the whole point — ClickFix is a UX-abuse tactic and you close it with policy, not patches. In priority order:

1. Block Win+R for standard users on Windows fleets, and log every use where you can’t. GPO: User Configuration → Administrative Templates → Start Menu and Taskbar → Remove Run menu from Start Menu. Yes, users will complain. That is a fine trade for closing the single most common ClickFix landing surface. If you can’t remove it, AppLocker / WDAC to deny powershell.exe, mshta.exe, wscript.exe, and cscript.exe invocation from user-writeable paths is the next line.
2. Kill clipboard-launched code paths in your browsers. Enterprise policy to block clipboard read access on unknown origins in Chrome/Edge (DefaultClipboardSetting = 2, ClipboardAllowedForUrls for the tiny set you actually need) removes the “copy this and paste it” step the lure depends on. Firefox lands the same result via dom.event.clipboardevents.enabled scoped correctly.
3. Cut the persistence path CERT-UA named. Files landing in a user’s Startup folder should be alerting, not autorunning. If your EDR isn’t already flagging VBS/JS in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\, add the rule today.
4. Treat VPN config files as secrets on the endpoint. COWARDDUCK’s shopping list — .ovpn, .conf, saved credential files — is now the shopping list for at least three unrelated Android stealers we’ve covered this month. DLP on those extensions leaving mobile devices, and rotate any config file that has ever been stored unencrypted on a phone.
5. Alert on outbound to steamcommunity[.]com from server-class hosts and workstations without a gaming population. It’s a legitimate service used as C2 dead-drop by more than one cluster now; benign on a laptop, load-bearing on a domain controller.

If you have Sandworm in your threat model already — utilities, telecom, government, defense-adjacent supply chain — priority-one there is (1) and (2), fleet-wide, this week. Everyone else: still (1) and (2), but you have until next patch cycle, not tonight.

For the indicator lists — SMARTAXE staging URLs, EtherHiding contract addresses, COWARDDUCK APK hashes — go to CERT-UA’s alert directly. We’re not going to mirror the IOC block here; the primary source updates as the operation evolves and ours would go stale by tomorrow.