UAC-0145 ClickFix Campaign — Sandworm / APT44 Sub-Cluster

CERT-UA published a consolidated advisory on the initial-access vectors used by UAC-0145, a sub-cluster of UAC-0002 (Sandworm / APT44 / Seashell Blizzard), the GRU-linked destructive-operations actor. The attacker objective is durable footholds on Ukrainian government, defence and military-adjacent endpoints, with at least one historical case where a consumer-grade compromise was pivoted into lateral movement and a destructive attack against a central executive authority's infrastructure.

The newly-detailed vector is ClickFix: during spring and summer 2026, victims visiting legitimate but compromised websites were shown a fake CAPTCHA that instructed them to copy a PowerShell command and run it in the Windows Run dialog or Windows Terminal. CERT-UA analysed the ClickFix implementation on more than ten compromised web resources during June–July 2026. Two cloaking mechanisms are in play: the commodity Cloaking.House traffic-filtering service, and a bespoke script named SMARTAXE which resolves its remote domain by calling an Ethereum smart contract (an eth_call against a hardcoded contract address and function selector) — an EtherHiding pattern that makes takedown of the resolver effectively impossible.

Post-execution the chain is deliberately low-tech and high-yield: the pasted command downloads a VBS file into the user's Startup autorun directory (GHETTOVIBE), which pulls down SCOUTCURL, a PowerShell recon script that inventories hardware, installed software, files and browser data to triage the victim's value. Loaders FLUIDLEECH (masquerading as an antivirus-removal utility) and LOADLOOP follow, and responded-to incidents also yielded FREAKYPOLL, a Python backdoor shipped as compiled .pyc bytecode. A parallel Android track distributes COWARDDUCK as an APK disguised as security software over messengers, exfiltrating contacts, files and live geolocation via the Dropbox API while retrieving commands from images hosted on legitimate services (including steamcommunity.com) proxied through proxy.duckduckgo.com.

Highest-value defensive angle: every Windows variant of this chain crosses two behavioural chokepoints that are cheap to monitor and rare in benign use — explorer.exe spawning a shell interpreter (the Run-dialog paste), and a script file landing in the per-user Startup autorun directory. Neither depends on an atomic indicator, so both survive infrastructure rotation. Atomic IOCs in this pack come directly from the CERT-UA advisory and are worth deploying, but the behavioural hunts are the durable coverage.

Defender priority: Hunt explorer.exe → powershell.exe and writes to …\Start Menu\Programs\Startup\ across the last 90 days before importing indicators. The lure is user-consented execution — EDR prevention policy will not stop a user who was told to paste the command, so detection and Run-dialog hardening (GPO NoRun / ASR script rules) carry the load.

Research decisions

• Indicator source of truth is CERT-UA only. Every hash and domain in this pack is transcribed from the advisory's indicator block; no indicator was carried from a secondary outlet.
• Correction applied: the C2 domain is offlce366[.]com — an L-for-i typosquat of "office366" — not office366[.]com. Several early write-ups render it as the latter. Blocking the wrong string yields zero coverage; the advisory's literal spelling is used throughout this pack.
• Not carried forward as atomic IOCs: Cloaking.House (a third-party service, not attacker-owned infrastructure), the SMARTAXE Ethereum contract address and function selector (not published), and any Dropbox API endpoint (the advisory names the service, not a host). These appear as behavioural signals instead.
• proxy[.]duckduckgo[.]com, images[.]stockmemory[.]site, images[.]stockmemory[.]space and steamcommunity.com are flagged by CERT-UA as legitimate resources abused for C2/dead-drop. They are shipped as hunt/enrich only — blocking them will generate business impact and will not stop the actor.
• Perishability: hashes are durable; the ten-plus compromised sites and the SMARTAXE-resolved domains rotate on the order of days-to-weeks. Re-pull the advisory before relying on network indicators past ~30 days.

Provenance: every atomic indicator in this pack traces back to the CERT-UA primary advisory; the corroborating sources supply narrative and attribution only.

Attack chain

Hunt hypotheses (fidelity-ordered)

All indicators transcribed verbatim from CERT-UA advisory 6318437. Domains are shown defanged.

Files

Network

Host

Not published, do not invent: the SMARTAXE Ethereum contract address and function selector, the Dropbox API tokens/endpoints, and the identities of the ten-plus compromised websites. Those slots ship as REPLACE_WITH_ placeholders in §10, not as guesses.

Windows event log / Sysmon

• Sysmon Event ID 1 — process create where ParentImage ends in explorer.exe and Image is powershell.exe, pwsh.exe, cmd.exe, wt.exe or mshta.exe. This is the ClickFix signature in a Sysmon-only estate.
• Sysmon Event ID 11 — file create where TargetFilename contains \Start Menu\Programs\Startup\. Baseline this for a week; in most estates the benign set is a handful of vendor shortcuts.
• PowerShell Operational 4104 (script-block logging) — script blocks containing both a download cradle and a Startup path, or containing Get-ComputerInfo alongside browser profile paths (SCOUTCURL shape).
• Security 4688 with command-line auditing enabled — same parent/child pattern as Sysmon ID 1 if Sysmon is not deployed.

Offline / forensic triage

• Dump HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU on any suspect host — this key retains what the user typed or pasted into the Run dialog, and survives long after process telemetry has aged out. It is the single highest-value artifact for confirming or ruling out ClickFix on a specific machine.
• List the contents of %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ and the machine-wide equivalent under %ProgramData%.
• Check for the existence of %LOCALAPPDATA%\SystemHelper\python\ — this directory has no legitimate reason to exist and its presence alone warrants escalation.

Web proxy / SWG

• Pull full-URL logs for the 90 days preceding any confirmed endpoint hit and identify the referring site — that site is compromised and its owner should be notified.
• Hunt for requests to Ethereum JSON-RPC endpoints (eth_call payloads to public RPC providers) originating from user browsers; this is the SMARTAXE resolver step and is unusual outside of Web3 development work.

Web properties you own (SMARTAXE server-side)

• File-integrity check on CMS theme and plugin JavaScript. CERT-UA names wp-header.js as a SMARTAXE artifact — a WordPress-shaped filename that blends into a theme directory. Compare all deployed JS against version control or a clean vendor archive.
• Review CMS user accounts, installed plugins and any webshells; CERT-UA notes explicitly that use of a site in this campaign is itself proof the site is compromised.

Mobile (COWARDDUCK)

• MDM inventory query for any installed package whose display name impersonates a security vendor but was sideloaded (installer package not the managed store).
• Alert on newly-granted ACCESS_FINE_LOCATION, READ_CONTACTS and storage permissions on sideloaded apps.
• Advise users that legitimate antivirus vendors never distribute APKs over Signal, WhatsApp or Telegram.

Three queries are strong enough to promote to Custom IOAs. The rest stay investigate-only until baselined.

Investigate-only (do not promote yet)

• Q6, Q7, Q9, Q11 — each has a real benign population (AV migrations, embedded Python, sync clients, inventory agents). Baseline for 14 days and convert exclusions into the IOA before promotion.
• Q8, Q10, Q12 — better served by Falcon IOC Management (see §10) than by an IOA, since they are pure atomic matching.

Deployment path

1. Endpoint security → Custom IOA rule groups → create a Windows rule group named UAC-0145-ClickFix.
2. Add each rule in Monitor action first; assign the group to a pilot prevention policy covering ~5% of workstations.
3. Review hits daily for 14 days, folding every benign hit into the rule's exclusion regex.
4. Promote to Detect (all three) and Prevent (the Q5 rule) estate-wide.

Use only benign, clearly-labelled test artifacts for the positive controls and remove them immediately afterwards. Never stage real campaign samples to validate a detection.

ClickFix defeats payload-blocking because the user supplies the execution. The controls below attack the technique at its three chokepoints: the paste surface, the interpreter, and the autorun directory.

Playbook 1 — Disable the Run dialog and harden script handlers (GPO / registry)

Apply to a pilot OU first. Step 1 removes the paste surface; step 2 makes script files inert on double-click.

REM 1. Remove the Run menu for standard users (User Configuration policy)
REM    GPO path: User Configuration -> Administrative Templates ->
REM              Start Menu and Taskbar -> Remove Run menu from Start Menu
REM    Registry equivalent (per-user hive):
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    NoRun            REG_DWORD    1

REM 2. Point script extensions at Notepad instead of the script hosts.
REM    Deploy as a per-user GPO preference or a logon script.
HKCU\Software\Classes\VBSFile\Shell\Open\Command
    (Default)        REG_SZ       notepad.exe "%1"
HKCU\Software\Classes\JSFile\Shell\Open\Command
    (Default)        REG_SZ       notepad.exe "%1"
HKCU\Software\Classes\WSFFile\Shell\Open\Command
    (Default)        REG_SZ       notepad.exe "%1"
HKCU\Software\Classes\JSEFile\Shell\Open\Command
    (Default)        REG_SZ       notepad.exe "%1"

REM 3. Verify after the policy has applied:
REM    gpresult /h report.html   then confirm NoRun = 1 in the user scope

Playbook 2 — Enforce the relevant ASR rules (PowerShell)

# Run elevated on each endpoint, or deploy via Intune / GPO / your RMM.
# Action value 1 = Block, 2 = Audit, 6 = Warn. Start at 2, move to 1 after a clean week.

$rules = @{
    # Block JavaScript or VBScript from launching downloaded executable content
    'd3e037e1-3eb8-44c8-a917-57927947596d' = 1
    # Block execution of potentially obfuscated scripts
    '5beb7efe-fd9a-4556-801d-275e5ffc04cc' = 1
    # Block Office applications from creating executable content
    '3b576869-a4ec-4529-8536-b80a7769e899' = 1
    # Block process creations originating from PSExec and WMI commands
    'd1e49aac-8f56-4280-b9ba-993a6d77406c' = 1
}

foreach ($id in $rules.Keys) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $id `
                     -AttackSurfaceReductionRules_Actions $rules[$id]
}

# Verify
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    '{0} = {1}' -f $p.AttackSurfaceReductionRules_Ids[$i],
                   $p.AttackSurfaceReductionRules_Actions[$i]
}

Playbook 3 — Enable PowerShell script-block and module logging (GPO / registry)

REM Machine-wide. Required to reconstruct what a pasted command actually executed.
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging
    EnableScriptBlockLogging          REG_DWORD    1
    EnableScriptBlockInvocationLogging REG_DWORD   1

HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging
    EnableModuleLogging               REG_DWORD    1
HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging\ModuleNames
    *                                 REG_SZ       *

HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription
    EnableTranscripting               REG_DWORD    1
    EnableInvocationHeader            REG_DWORD    1
    OutputDirectory                   REG_SZ       \\FILESERVER-01\pstranscripts$

REM Ensure the transcript share is append-only for endpoints and readable only by IR.

Playbook 4 — Estate-wide triage sweep (PowerShell, read-only)

# Read-only collection. Run via your RMM or Falcon RTR against the estate and
# review centrally. Collects the four artifacts that confirm or rule out ClickFix.

$out = [ordered]@{ Host = $env:COMPUTERNAME; User = $env:USERNAME }

# 1. Run-dialog history - the paste itself
$mru = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
$out.RunMRU = if (Test-Path $mru) {
    (Get-ItemProperty $mru).PSObject.Properties |
        Where-Object { $_.Name -match '^[a-z]$' } |
        ForEach-Object { $_.Value }
} else { 'none' }

# 2. Contents of the per-user Startup autorun directory
$startup = "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"
$out.Startup = Get-ChildItem $startup -Force -EA SilentlyContinue |
    Select-Object Name, Length, CreationTimeUtc

# 3. FREAKYPOLL staging directory - existence alone is an escalation
$out.SystemHelper = Test-Path "$env:LOCALAPPDATA\SystemHelper\python"

# 4. Hashes of anything script-like sitting in Startup
$out.StartupHashes = Get-ChildItem $startup -Force -EA SilentlyContinue |
    Where-Object { $_.Extension -match '\.(vbs|vbe|js|jse|wsf|hta|ps1|exe|lnk)$' } |
    ForEach-Object { '{0} {1}' -f (Get-FileHash $_.FullName -Algorithm SHA256).Hash, $_.Name }

[pscustomobject]$out | ConvertTo-Json -Depth 4

Playbook 5 — Web-property integrity check for SMARTAXE (shell)

# Run on any web server you own that could have been used to serve the lure.
# SMARTAXE was observed as wp-header.js - a CMS-theme-shaped filename.

# 1. Any JavaScript modified in the last 90 days under the web root
find /var/www -type f -name '*.js' -mtime -90 -printf '%TY-%Tm-%Td  %p\n' | sort

# 2. Hash every deployed JS file and diff against a clean vendor archive
find /var/www -type f -name '*.js' -exec sha256sum {} \; | sort -k2 > deployed.sha256
# then:  diff <(sort -k2 known-good.sha256) deployed.sha256

# 3. Look for the smart-contract resolver pattern SMARTAXE uses
grep -rIl -e 'eth_call' -e 'eth_chainId' -e 'window.ethereum' /var/www 2>/dev/null

# 4. Look for injected loaders in theme headers and footers
grep -rIn -e 'document.write' -e 'atob(' -e 'fromCharCode' /var/www --include='*.js' \
    --include='*.php' 2>/dev/null | head -50

# 5. Review CMS accounts and plugins for unexpected additions, then rotate all
#    admin credentials and any API keys the host held.

Escalation trigger: a confirmed FREAKYPOLL, FLUIDLEECH or LOADLOOP hit means the actor moved past triage recon and considered the host worth a backdoor. Escalate to full incident response immediately — this cluster's historical pattern is foothold, lateral movement, then destructive action.

Known gaps and what to do about them

• Web tier (3 gaps). Everything before the paste happens on infrastructure you do not control. Closing this requires proxy full-URL logging plus FIM on your own web properties — Playbook 5 covers the latter.
• Android (1 gap). Without MDM or Falcon for Mobile there is no COWARDDUCK telemetry at all. On BYOD this is a policy problem, not a detection problem.
• Encrypted DNS. Browser-level DoH removes DnsRequest visibility and silently blinds Q8 and Q9. Disable browser DoH by policy or force resolution through an inspected resolver.
• Registry telemetry. If RegGenericValueUpdate is trimmed in your sensor policy, Q2 returns nothing and looks clean rather than blind — validate with gate G1 before trusting it.

Validation summary: gates G1–G8 in §11 govern promotion. G1 (telemetry present) and G3–G5 (positive controls) must pass before any query is treated as coverage; G2 and G6 (baseline and negative control) must pass before any IOA moves past Monitor; G8 governs the move to Prevent. A query that has not passed its gate is a hypothesis, not a detection.