# UAC-0145 ClickFix Strategy: How Sandworm Targets Ukraine with Malware

> Russian threat actor UAC-0145 uses deceptive ClickFix CAPTCHAs to deliver data-stealing malware to Ukrainian targets. Learn how to detect and mitigate these TTPs.

- Published: 2026-07-19T16:59:50.000Z
- Severity: high
- Category: Threat Intel
- Tags: UAC 0145, Sandworm, ClickFix, Ukraine, Malware, Phishing
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html
- Canonical: https://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malware

## Key points

- Russian state-sponsored actors are compromising Ukrainian systems to exfiltrate sensitive data through deceptive social engineering techniques.
- Windows-based devices in Ukraine are the primary targets of the UAC-0145 phishing and ClickFix campaigns.
- Organizations must implement user awareness training regarding fake CAPTCHAs and restrict PowerShell execution to prevent unauthorized script runs.

## Campaign Overview

Recent intelligence indicates that UAC-0145, a sub-cluster of the notorious [Sandworm](https://en.wikipedia.org/wiki/Sandworm) (also known as APT44), is actively targeting Ukrainian organizations using a highly effective social engineering tactic. According to [The Hacker News](https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html), this campaign leverages the "ClickFix" strategy to deceive users into compromising their own systems. UAC-0145, which is an [APT](/glossary#apt) group affiliated with the Russian GRU, has increasingly turned to these deceptive methods to bypass traditional technical security controls.

The campaign typically begins with a targeted [Phishing](/glossary#phishing) email. When a recipient clicks a malicious link within the email, they are directed to a spoofed webpage that mimics a legitimate service but displays a fake error message. This [TTP](/glossary#ttp) is designed to exploit the user’s desire to resolve a technical hurdle quickly, often by presenting a fraudulent CAPTCHA or system update prompt.

## Technical Analysis: The ClickFix Mechanism

The ClickFix strategy represents a shift in social engineering effectiveness. Instead of relying solely on traditional macro-enabled documents or direct executable downloads, UAC-0145 utilizes a "copy-paste" instruction set. When the victim visits the malicious site, they encounter a dialog box claiming that a browser error has occurred. To "fix" the error, the site instructs the user to click a button that copies a malicious command to their clipboard and then paste that command into a PowerShell terminal or the Windows 'Run' dialog.

### UAC-0145 Sandworm Ukraine Cyber Attacks and PowerShell Exploitation

By convincing the user to manually execute the command, the attacker effectively bypasses many automated [EDR](/glossary#edr) and email security filters that might otherwise flag a malicious attachment. The pasted command usually triggers a hidden PowerShell script that establishes a connection with a [C2](/glossary#c2) server. This script then downloads and executes a second-stage payload, typically a data-stealing malware variant designed to exfiltrate sensitive files, credentials, and system information.

Defense teams researching **how to detect ClickFix CAPTCHA malware** should look for anomalous PowerShell executions initiated via the Windows Shell (explorer.exe) rather than legitimate administrative tools. Because the victim is the one initiating the execution, traditional reputation-based filters for external files are often rendered ineffective. Identifying these [IoC](/glossary#ioc) markers requires deep visibility into command-line arguments and process parent-child relationships within the [SOC](/glossary#soc).

## Strategic Implications

The involvement of UAC-0145 highlights the continued focus of Russian military intelligence on Ukrainian infrastructure and government assets. While Sandworm is traditionally known for destructive [DDoS](/glossary#ddos) or disruptive attacks, this sub-cluster's focus on information theft suggests a dual-track objective of both disruption and intelligence gathering. The use of ClickFix indicates that threat actors are successfully adapting to hardened technical environments by refocusing on the human element.

## Mitigation and Defense Strategies

To defend against this specific threat, organizations should prioritize a multi-layered defense strategy that incorporates both technical controls and user education. Relying on a [Zero Trust](/glossary#zero-trust) architecture can limit the potential damage if a single workstation is compromised.

*   **PowerShell Restriction:** Use AppLocker or Windows Defender Application Control (WDAC) to restrict PowerShell execution to signed scripts only or disable it for non-administrative users entirely.
*   **User Education:** Conduct simulation training specifically focused on fake CAPTCHA prompts. Users must be taught that legitimate web services will never ask them to copy and paste code into a terminal to fix a browser error.
*   **Monitoring and Detection:** Configure your [SIEM](/glossary#siem) to alert on PowerShell commands containing encoded flags (e.g., `-enc`, `-EncodedCommand`) or those that download content from unusual external domains.
*   **Clipboard Security:** While difficult to block entirely, monitoring process execution that follows a clipboard 'Paste' event can help identify active exploitation attempts in real-time.

**Related:** [ChatGPT Share Link Abuse: Fake Outages Deliver Malware](/blog/chatgpt-share-link-abuse-fake-outages-deliver-malware), [Ghostwriter Targets Ukraine with Geofenced PDF Phishing & Cobalt Strike](/blog/ghostwriter-targets-ukraine-with-geofenced-pdf-phishing-cobalt-strike)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/uac-0145-clickfix-strategy-how-sandworm-targets-ukraine-with-malware