UAC-0145 is a threat label used by CERT-UA and other analysts to track a specific cluster of malicious activity. It is not a malware family, exploit, or tool; it is a name for an actor or operator set that appears to reuse related tactics, infrastructure, and targeting patterns. In public reporting, UAC-0145 has been associated with activity linked to Sandworm, which is widely tracked as part of Russia’s GRU ecosystem.
This kind of label matters because it helps defenders connect separate incidents into one campaign picture. If multiple phishing, lure-based, or self-execution attacks share the same methods, a cluster name can guide hunting, incident triage, and threat intelligence sharing. In practice, seeing UAC-0145 in a report suggests analysts have linked the behavior to a known track record, but it does not prove every detail of attribution. For defense, the value is practical: monitor for social engineering, suspicious command execution, and post-click compromise patterns that fit the cluster’s style.