APT / THREAT GROUP

GIFTEDCROOK

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to CERT-UA, this stealer used by UAC-0226 is written in C/C++, targeting browser databases and using telegram for data exfiltration.

Threat Analysis

GIFTEDCROOK is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://arcticwolf.com/resources/blog/giftedcrook-strategic-pivot-from-browser-stealer-to-data-exfiltration-platform/

→https://blog.synapticsystems.de/category/threat-actors/uac-0226/

→https://cert.gov.ua/article/6282946

→https://cip.gov.ua/services/cm/api/attachment/download?id=71278

→https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

GIFTEDCROOKwin.giftedcrook

External Intelligence

Malpedia: win.giftedcrook

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search GIFTEDCROOK