SerpApi.Org
Ukraine's national cybersecurity authority disclosed this past Sunday that Sandworm — Russia's GRU-linked hacking unit, responsible for some of history's most destructive cyberattacks — has adopted a radically different approach to compromising Ukrainian targets: tricking ordinary internet users into infecting their own computers through fake CAPTCHA prompts, then hiding the campaign's command-and-control servers inside the Ethereum blockchain where no authority can take them down.
The Computer Emergency Response Team of Ukraine (CERT-UA) attributed the active campaign to UAC-0145, a confirmed sub-cluster within Sandworm also tracked by vendors as APT44 and Seashell Blizzard. Investigators found more than ten compromised Ukrainian websites serving as delivery points, a cross-platform malware arsenal of nine distinct families targeting both Windows and Android devices, and a technical evasion architecture that defeats the standard playbook defenders use to disrupt nation-state cyberattacks.
The agency formally attributed the campaign in a July 19, 2026 advisory.
What Sandworm's Fake CAPTCHA Does — and Why It Bypasses Most Defenses
ClickFix — the social engineering technique at the center of this campaign — works by displaying a pop-up on a compromised website that mimics a routine CAPTCHA verification prompt. The message tells the visitor that an extra step is required to confirm they are human. The "extra step" is to press a key sequence that opens the Windows Run dialog, paste in a command that the page has already copied to the clipboard, and press Enter. The command is not a CAPTCHA response. It is malware.
The technique's power lies in what it does not require. There is no exploit to patch, no malicious email attachment to quarantine, and no software vulnerability that a security update could close. The victim performs the malicious action themselves, under the impression they are doing something routine. A detailed analysis by Microsoft's Security Blog describes how the technique exploits users' tendency to resolve perceived technical issues, making it effective against users who would otherwise be cautious about clicking suspicious links.
ESET measured a 517% surge in ClickFix attacks during the first half of 2025 alone, with the technique accounting for nearly 8% of all blocked attacks across the company's global sensor network. CERT-UA confirmed Sandworm's shift toward fake CAPTCHA prompts as one of the most notable changes in the group's operating methods observed to date.
EtherHiding: Why Defenders Cannot Simply Take Down the Servers
What distinguishes this campaign from standard ClickFix deployments is where Sandworm hides its command-and-control infrastructure. Instead of registering domains or renting servers that can be seized, blocked, or court-ordered offline, UAC-0145 stores its C2 addresses inside an Ethereum smart contract — immutable code living on the blockchain that no registrar, law enforcement agency, or hosting provider can remove or modify.
The mechanism operates through a custom tool the attackers developed called SMARTAXE, which is injected into compromised websites. When a targeted visitor arrives, SMARTAXE makes an eth_call — a read-only query to the Ethereum network — to retrieve the current C2 domain address stored in the contract's data. The address is then used to load and display the fake CAPTCHA, or redirect the visitor to malicious content.
The key property of this architecture is that the attacker retains full control over the C2 address while defenders retain none. If Sandworm wants to move to a new server, it calls the smart contract's update function, and every infected machine worldwide begins pointing to the new address within minutes. If defenders want to block it, they cannot touch the contract — they can only attempt to block outbound queries to Ethereum RPC provider endpoints at the network perimeter, a measure that requires recognizing and filtering specific API calls that Sandworm designed to resemble ordinary traffic. This technique, known in threat intelligence circles as EtherHiding, was first documented by security researchers in 2023 and has since been adopted by multiple nation-state and criminal actors.
Alongside SMARTAXE, the attackers used Cloaking.House, a commercial traffic-filtering service that allows a web server to present entirely different content to different visitors. Automated security scanners and researchers visiting the compromised sites see a normal, benign webpage. Only visitors who match the attacker's targeting criteria — specific geolocation, browser fingerprint, or referral path — are shown the fake CAPTCHA. CERT-UA warned that any website involved in these attacks should be treated as fully compromised, potentially through vulnerable content management systems, stolen administrator credentials, web shells, or malicious server-side plugins.
Attack Chain: From Fake CAPTCHA to Full System Compromise
When a targeted visitor executes the pasted PowerShell command, the initial payload downloads GHETTOVIBE — a Visual Basic Script file that establishes persistence by copying itself into the Windows Startup directory, ensuring it runs automatically every time the machine boots. The attacker then deploys SCOUTCURL, a PowerShell reconnaissance script that harvests a profile of the infected machine: hardware specifications, installed software, local file listings, and browser data. That profile is sent back to the attacker to determine whether the target justifies further investment.
From there, the campaign's remaining malware families activate in layers. FLUIDLEECH and LOADLOOP function as loaders, pulling and executing additional payloads. FLUIDLEECH specifically disguises itself as antivirus removal software to lower victim suspicion while it runs. FREAKYPOLL, a Python-based backdoor distributed as compiled bytecode files, provides persistent remote access. Three additional backdoor families — KALAMBUR, SUMBUR, and TAMBUR — are deployed on systems where the attacker decides to maintain a longer-term presence.
For lateral movement through compromised networks, UAC-0145 leaned on legitimate utilities including OpenSSH and Tor, forwarding local network ports 445 (SMB), 3389 (RDP), and 22 (SSH) back to attacker-controlled infrastructure — blending malicious traffic into the normal flow of remote administration tools. Separate modules were deployed to steal stored message history from Signal and WhatsApp, with exfiltration carried out via the RSYNC file-transfer utility.
Android Targets: Malware Arrives as Fake Security Apps
The campaign's reach extended beyond Windows. CERT-UA also identified UAC-0145 distributing backdoored Android APK files through messaging applications, disguised as security tools or antivirus applications.
The embedded Android malware, tracked as COWARDDUCK, is a full-featured mobile backdoor. Once installed, it covertly collects contacts, real-time geolocation data, and files from directories including DCIM, Documents, Downloads, Pictures, and Alarms — targeting formats such as DOCX, XLSX, PPTX, ZIP, RAR, OVPN, and JSON. In a kinetic conflict zone where device location data can carry lethal implications, the geolocation collection capability is particularly significant.
Stolen data is uploaded via the Dropbox cloud service API, while COWARDDUCK receives its commands from attacker-controlled servers and — in a technique designed to blend malicious traffic into ordinary internet use — by querying pages on steamcommunity.com through a proxy layer. This abuse of a gaming platform's community pages as a command channel exploits the fact that security teams are unlikely to block or flag traffic to Steam as a threat indicator.
Sandworm's Tactical Evolution: From Torrent Malware to Web-Based Social Engineering
The pivot to ClickFix marks a documented departure from prior Sandworm campaigns. The group previously relied on distributing trojanized copies of Microsoft Windows and Office installers through torrent sites, compromising users who downloaded pirated software. In at least one documented case from the current campaign period, a torrent-based infection gave Sandworm an initial foothold inside a Ukrainian government network that the group then leveraged to escalate further.
The shift is strategically significant for defenders. A trojanized installer requires a deliberate software download — a specific, detectable user action. A fake CAPTCHA can appear on any website a user visits in the course of routine browsing. As Bitdefender researchers noted, the attack surface expands from users who seek out pirated software to the entire Ukrainian internet-using population.
CERT-UA stated the group has been tracked under the UAC-0145 designation for several years and called the move toward ClickFix one of the most notable tactical shifts observed in the group's operating methods. The adoption follows a broader criminal and nation-state trend: ClickFix has also been used in 2026 to distribute OXLOADER, SCMBANKER, TELEPUZ, and ACR Stealer, among others.
What CERT-UA Recommends
CERT-UA's advisory urges Ukrainian website administrators and hosting providers to conduct thorough audits of web infrastructure for signs of compromise, including modified scripts, unauthorized plugins, and server-side backdoors. Administrators should rotate credentials and enforce multi-factor authentication on content management system platforms, and should monitor outbound traffic for anomalous connections to Ethereum RPC nodes or cloud storage APIs such as Dropbox.
For end users — in Ukraine and globally — the defensive takeaway is specific and actionable: no legitimate website, browser verification system, or CAPTCHA service will ever ask a visitor to open a command prompt and paste in a command. Any such prompt, regardless of how convincingly it is formatted or how routine it appears, is an attack.
Background: Sandworm's Record as Russia's Most Destructive Cyber Unit
Sandworm has operated under Russia's GRU military intelligence directorate since at least 2007, designated GRU Military Unit 74455. US Attorney Scott Brady described the group's record as "representing the most destructive and costly cyber-attacks in history" at the October 2020 announcement of DOJ indictments against six alleged Unit 74455 officers. The group's documented attacks include the 2015 and 2016 blackouts against Ukraine's power grid — the first confirmed malware-induced civilian electricity outages in history — the 2017 NotPetya malware that caused an estimated $10 billion in global economic damage, and the 2018 cyberattack that disrupted the Winter Olympics opening ceremony in Pyeongchang. These historical attacks are documented in detail in research on the group's decade-long record. In December 2023, Sandworm's attack on Kyivstar, Ukraine's largest mobile operator, disrupted communications for approximately 24 million Ukrainians.
Mandiant formally elevated Sandworm to APT44 status in 2024, reflecting the group's sustained global threat posture and novel operational technology capabilities. The emergence of UAC-0145 as a distinct sub-cluster with its own evolving tradecraft — now including fake CAPTCHAs, blockchain C2, and cross-platform malware — illustrates how GRU structures its cyber operations to enable different teams to develop specialized techniques while operating under common strategic objectives.
Frequently Asked Questions
What is ClickFix and how does it work?
ClickFix is a social engineering attack technique that displays a fake error message or CAPTCHA prompt on a compromised website, then instructs the visitor to copy a command into the Windows Run dialog or terminal and press Enter. JavaScript on the page has already placed the malicious command on the clipboard before the user sees the instructions. Because the user executes the command themselves using system tools already present on the machine, no malicious file is dropped and no software exploit is required — conventional endpoint detection tools may not flag anything before the attack succeeds.
Why can't CERT-UA or law enforcement simply shut down Sandworm's servers?
In a conventional cyberattack campaign, defenders can disrupt operations by seizing the attacker's registered domain names, sinkholing their C2 servers, or obtaining court orders against hosting providers. None of those mechanisms work in this campaign. UAC-0145 stored its C2 server addresses inside an Ethereum smart contract — immutable code on the blockchain that no authority can modify, delete, or court-order offline. Operators can update the stored address to point to a new server at any time, instantly rerouting all infected machines worldwide, while defenders are left with only one practical network-level option: identifying and blocking outbound queries to Ethereum RPC provider endpoints, which requires detecting API calls that Sandworm deliberately designed to resemble ordinary CDN traffic.
What data does the Android malware COWARDDUCK steal?
COWARDDUCK collects contacts, real-time GPS geolocation, and files from multiple device directories — targeting document formats including DOCX, XLSX, PPTX, and ZIP archives, as well as configuration files including OVPN and JSON. The data is exfiltrated through the Dropbox API. The malware also receives commands by querying attacker-controlled servers and, separately, by reading specific pages on steamcommunity.com through a proxy layer — a technique designed to disguise command traffic as traffic to a legitimate gaming platform.
How can I recognize and avoid a fake CAPTCHA attack?
No legitimate website, browser, or security service will ever ask you to open a Windows Run dialog, a command prompt, or a terminal and paste in a command. If a website tells you to press Win+R (or equivalent), copy text to a dialog box, or execute any command through a system utility as part of a "verification" or "security check," the site is either compromised or purpose-built for attack. Close the browser tab immediately and do not execute the suggested command. If you are a website administrator, monitor your site's JavaScript and plugin files for unauthorized modifications, enforce multi-factor authentication on your CMS login, and report any suspicious indicators to CERT-UA or your national cybersecurity authority.
Related Articles
