Microsoft PowerPoint - UAC0006 Covers.pptx

The CIROC SCPC Ukraine report documents the UAC-0006 SmokeLoader campaigns in 2023, detailing mass phishing attacks that distribute a download-and-run malware via polyglot archives and multi-stage infection chains (zip/js/vbs/exe, PowerShell and WScript usage). It provides attack timelines by month, infection chain mappings, indicators of compromise, MITRE ATT&CK and NIST references, and an analysis of the campaign infrastructure and active vs. total domains used for C2 to illustrate the scope and resilience of the threat.