UAC-0184: From HTA to a Signed Network Stack

by Robin Dost EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007 (Malwarebox IDIIM Chain: https://feed.iim.malwarebox.eu/chain/uac-0184-pseudo-png-passmark-2026-05 In the last articles, I spent quite some time looking at actors that primarily target Ukraine. Gamaredon and APT28 are the obvious names…