NOTABLENATOA2threat

CERT-UA: Sandworm subcluster UAC-0145 pairs ClickFix fake-CAPTCHA with Ethereum-smart-contract C2 resolution and a Signal-delivered Android backdoor

GRU's Sandworm adopts ClickFix, blockchain-hidden C2 (EtherHiding) and a Signal-lured Android backdoor, transferable tradecraft for EU CI defenders

first published 2026-07-20 04:30 UTC

Analysis

CERT-UA reports that UAC-0145, a subcluster of UAC-0002 / Sandworm (APT44, Seashell Blizzard), the GRU-linked destructive-actor family, compromised at least 10 legitimate websites between June and July 2026 to serve a fake CAPTCHA that instructs visitors to paste and run a PowerShell command in the ClickFix pattern (The Hacker News, 2026-07-19). The PowerShell one-liner drops a VBS persistence stub into the Startup folder ("one of the variants of such a program was called GHETTOVIBE," per CERT-UA) which stages a PowerShell reconnaissance script (SCOUTCURL) that profiles the host, while two loaders, FLUIDLEECH (masquerading as software for removing computer viruses) and LOADLOOP, fetch a Python backdoor, FREAKYPOLL (The Hacker News, 2026-07-19). The compromised-site injection uses a bespoke tool, SMARTAXE, layered on the commodity Cloaking.House traffic-filtering service to serve different content by visitor; the injected CAPTCHA "content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract" (The Hacker News, 2026-07-19); a eth_call-style read that replaces a hardcoded C2 domain and survives takedowns because the resolution layer lives on-chain.

Separately, UAC-0145 distributes a full-featured Android backdoor, COWARDDUCK, via Signal disguised as security software; it collects contacts, files matching targeted extensions, and real-time geolocation, uploading via the Dropbox API and pulling C2 tasking from content hosted on legitimate services (e.g. Steam Community) proxied through a public search-engine proxy, both chosen to blend into normal outbound traffic (CERT-UA, 2026-07-19). CERT-UA frames this as a continuation of its multi-year UAC-0145 tracking; the group's earlier tradecraft (trojanized torrent installers, Signal "antivirus" lures) is background; the in-window delta is the ClickFix vector, the EtherHiding C2-resolution layer, and the COWARDDUCK mobile backdoor. The ClickFix pivot marks a departure from Sandworm's prior reliance on trojanized Windows/Office installers (The Hacker News, 2026-07-19).

Defender takeaway

Sandworm is a standing threat to European critical infrastructure and government, so this technique stack matters to EU/Swiss defenders even though the current victims are in Ukraine. Hunt on the desktop chain: a Startup-folder VBS created around the time a browser presents a "CAPTCHA" asking the user to open Win+R or a terminal and paste text; PowerShell child processes of explorer.exe or a browser with no prior parent-child history (process-creation telemetry with lineage, Sysmon EID 1, EDR process events); and, for the EtherHiding tell, outbound eth_call-style JSON-RPC traffic to public Ethereum nodes originating from endpoints rather than developer tooling. For mobile fleets, treat Signal-delivered APKs claiming to be AV/security tools as hostile, and watch BYOD/MDM egress for the Dropbox-API-plus-legitimate-platform C2 pattern. Triage: developer and IT-admin hosts legitimately spawn PowerShell from many parents and legitimately query blockchain nodes; the discriminators are (1) the PowerShell instance being a child of a browser/explorer immediately after a web CAPTCHA prompt, paired with a new Startup-folder VBS, and (2) eth_call traffic from a general-purpose endpoint with no Web3 developer role; either alone is weak, the sequence is the signal.

Cited evidence

The CAPTCHA content to be injected into the web page employs the EtherHiding technique to retrieve the domain name of the remote resource from an Ethereum smart contract using an address specified in the source code.

The malware embedded in the APK file is a full-featured backdoor codenamed COWARDDUCK that can clandestinely collect the following details

The Hacker News 2026-07-19

Sources2

CERT-UAprimary · 2026-07-19 The Hacker Newscorroborating · 2026-07-19

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Key facts

Assessment

NATOA2NATO Admiralty code

Source reliabilityA Completely reliable

Info credibility2 Probably true

Verificationsingle-source · national CERT

Confidencehigh

CERT-UA is the primary disclosing authority for its own jurisdiction (national-CERT carve-out); The Hacker News (2026-07-19) provides English-language corroboration but its facts derive from the same CERT-UA advisory, so this is effectively single-origin. The CERT-UA page's 'Published Time' metadata reads 2026-03-10, which contradicts the article's own June–July 2026 activity dates, treated as a site-metadata artefact, with the in-window reporting date anchored to the 2026-07-19 disclosure. No attacker-controlled indicators are reproduced (no-IOC policy); abused legitimate platforms are named only as technique.

Sectors

public-sectordefense

Record

Published2026-07-20 04:30 UTC

Event date2026-07-19

Sources2

Raw sourceindex.md

Produced by2026-07-20T0409Z-intel