Ukraine-Focused APT Group UAC-0184 Conducts Viber Espionage Campaign Against Ukrainian Targets

Viber-Based Espionage Operations

Threat group UAC-0184 has conducted a sophisticated espionage campaign targeting Ukrainian individuals through the popular Viber messaging platform, as documented in reports from January 5, 2026. The operation represents a specialized approach to intelligence collection that exploits the widespread use of Viber communications in Ukraine during the ongoing conflict with Russia.

Platform-Specific Targeting

The campaign leverages Viber's popularity in Eastern European markets to conduct intelligence gathering operations against Ukrainian targets. UAC-0184's focus on this specific messaging platform demonstrates advanced understanding of regional communication preferences and suggests the group has developed specialized capabilities for compromising Viber-based communications.

Operational Context

The espionage campaign occurs within the broader context of extensive cyber operations targeting Ukraine since the beginning of the Russian invasion. UAC-0184's activities represent one component of sustained intelligence collection efforts designed to gather information on Ukrainian military, government, and civilian activities through compromised communications platforms.

Technical Methodology

While specific technical details of the compromise method were not fully disclosed, the operation appears to involve sophisticated techniques for intercepting or manipulating Viber communications to extract intelligence from Ukrainian targets. The campaign's success suggests advanced capabilities for mobile platform exploitation and social engineering targeting Ukrainian users.

Strategic Intelligence Objectives

The targeting of Ukrainian civilians and officials through Viber indicates the group's intelligence collection priorities focus on understanding Ukrainian activities, communications patterns, and potentially gathering tactical information relevant to ongoing military operations. This represents a continuation of systematic efforts to compromise Ukrainian information security across multiple platforms and channels.