From c0fd66e3cd7e3c76fff3afade1bb6a6f834a991c Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Tue, 7 Nov 2023 14:47:12 +0100
Subject: [PATCH] [threat-actors] Add UAC-0094

---
 clusters/threat-actor.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index de791d9..d3bbbf8 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12659,6 +12659,18 @@
       },
       "uuid": "d0e1811e-53f9-48b5-b2ef-107e0f53239b",
       "value": "UserSec"
+    },
+    {
+      "description": "State Service of Special Communication and Information Protection of Ukraine spotted a new wave of cyber attacks aimed at gaining access to users’ Telegram accounts. The Ukrainian CERT attributes the hacking campaign to threat actors tracked as UAC-0094. Threat actors are targeting Telegram users by sending Telegram messages with malicious links to the Telegram website in order to gain unauthorized access to the records and transfer a one-time code from SMS.",
+      "meta": {
+        "country": "RU",
+        "refs": [
+          "https://cert.gov.ua/article/39253",
+          "https://vulners.com/thn/THN:4C1C2CD10F20E08DD74D465450DF3F17?utm_source=rss&utm_medium=rss&utm_campaign=rss"
+        ]
+      },
+      "uuid": "def3c4e4-9d59-478f-8895-d3850cfa99c3",
+      "value": "UAC-0094"
     }
   ],
   "version": 292