UAC-0098

A financially motivated cluster linked to former Conti, TrickBot, and IcedID operations that shifted toward politically aligned targeting of Ukraine in 2022. It attacked government, hospitality, and humanitarian organizations using phishing and commodity malware and overlaps with ITG23 reporting.