Ukraine’s Computer Emergency Response Team (CERT-UA) has disclosed a sophisticated cyber campaign attributed to UAC-0145, a subgroup of Sandworm, the hacking operation linked to Russian military intelligence. In a July 19, 2026 advisory, CERT-UA said the attackers had substantially changed their methods by using fake CAPTCHA prompts to trick users into infecting their own computers, while hiding command-and-control (C2) infrastructure inside the Ethereum blockchain.

According to CERT-UA, the campaign moves away from conventional malware delivery techniques that rely on software exploits or malicious email attachments. Instead, compromised websites show counterfeit CAPTCHA or error messages that tell visitors to open the Windows Run dialog or terminal, paste a command that embedded JavaScript has already copied to the clipboard, and execute it. Because the victim runs the malicious command directly through legitimate system utilities, the technique can bypass traditional endpoint security tools that are typically designed to detect suspicious software installation activity.

CERT-UA said Sandworm’s adoption of fake CAPTCHA prompts and Ethereum-based command infrastructure marks a notable development in the group’s cyberattack tactics and makes disruption significantly more difficult. For defenders, the campaign also underscores a broader challenge: attacks that rely on user-driven command execution and legitimate system tools often require monitoring behavior, script activity, and outbound network patterns rather than only scanning for malicious files.

Blockchain Infrastructure Complicates Defensive Response

Investigators said one of the campaign’s most important innovations is the use of Ethereum smart contracts to store C2 server addresses. Unlike cyber operations that depend on registered domains or centralized hosting providers, blockchain-based smart contracts cannot be easily removed, changed, or disabled through legal or administrative measures.

CERT-UA said the attackers used a custom tool called SMARTAXE to retrieve updated C2 addresses through read-only queries to the Ethereum network. That approach allows operators to redirect infected systems to new servers almost immediately, while preventing defenders from disabling the underlying blockchain infrastructure. As a result, security teams face the difficult task of detecting and blocking outbound requests to Ethereum Remote Procedure Call (RPC) endpoints that have been deliberately made to resemble normal content delivery network traffic.

The advisory also said the attackers used Cloaking.House, a commercial traffic-filtering service that displays different website content depending on the visitor. Automated security scanners may therefore see harmless web pages, while intended victims are served malicious CAPTCHA prompts. CERT-UA warned that any website displaying this content should be treated as fully compromised, possibly through stolen administrator credentials, vulnerable content management systems, malicious plugins, or web shells.

Malware Targets Windows and Android Devices

After a victim executes the malicious PowerShell command, a multi-stage infection process begins. The initial malware establishes persistence on Windows systems, followed by reconnaissance tools that gather details about hardware, installed software, browser data, and local files. Based on the information collected, the attackers selectively deploy additional malware families that provide persistent remote access and support lateral movement across compromised networks.

The campaign also uses legitimate administration tools, including OpenSSH and Tor, in an effort to make malicious activity appear similar to ordinary network traffic. Other modules are designed to target stored conversations from messaging applications such as Signal and WhatsApp, while stolen data is transferred through standard file synchronization utilities.

The operation uses a layered malware framework against both Windows and Android devices, combining reconnaissance, persistent remote access, credential theft, messaging data collection, and cloud-based data exfiltration. The inclusion of Android malware broadens the defensive scope beyond enterprise Windows endpoints, particularly where employees use mobile messaging apps or personal devices to exchange work-related information.

CERT-UA also identified Android malware called COWARDDUCK, which is distributed through messaging applications while disguised as security or antivirus software. Once installed, the malware collects contacts, real-time geolocation data, and files from commonly used folders on the device, including documents, downloads, photographs, and archives. Stolen information is sent through the Dropbox API, while commands are received from attacker-controlled servers and selected Steam Community pages, allowing malicious communications to blend with legitimate internet traffic.

The agency said the latest campaign reflects a strategic shift from Sandworm’s previous reliance on trojanized software installers distributed through torrent platforms. By placing fake CAPTCHA prompts on compromised websites, the attackers significantly broaden their potential victim pool beyond people downloading unauthorized software.

CERT-UA Calls for Stronger Web Security Measures

CERT-UA urged website administrators to audit their web infrastructure for unauthorized scripts, compromised plugins, and server-side backdoors. The agency also recommended enforcing multi-factor authentication and rotating administrative credentials.

In addition, CERT-UA advised organizations to monitor outbound connections for unusual traffic directed to Ethereum RPC services and cloud storage platforms. The agency stressed that no legitimate website, browser, or CAPTCHA service will ever ask users to open a command prompt or system terminal and execute commands. CERT-UA warned that any such request should be treated as an active cyberattack and ignored immediately.