The activity associated with Russia of the UAC-0184 group was first documented by Ukrainian [CERT-UA team](https://socprime.com/blog/uac-0184-attack-detection-targeted-phishing-attacks-against-the-armed-forces-of-Ukraine-using-remcos-rat-and-reverse-ssh/) in early January 2024. Since then, systematic campaigns have been observed against Ukrainian state structures, in peculiar defence-related ones.
