Russia-Nexus UAC-0113 Emulating Telecommunication Providers in Ukraine

Recorded Future/Insikt Group documents UAC-0113 (linked by CERT‑UA to Russian GRU/Sandworm) reusing dynamic DNS domains spoofing Ukrainian telecoms to deliver malicious ISO files via HTML smuggling that install Colibri Loader and Warzone RAT; the report provides malware technical analysis, C2/infrastructure and IOC listings, ATT&CK mappings, and mitigations for detection and blocking.