MALWARE FAMILY

GIFTEDCROOK

Internal ID: win.giftedcrook

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to CERT-UA, this stealer used by UAC-0226 is written in C/C++, targeting browser databases and using telegram for data exfiltration.

Threat Analysis

GIFTEDCROOK is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://arcticwolf.com/resources/blog/giftedcrook-strategic-pivot-from-browser-stealer-to-data-exfiltration-platform/

→https://cert.gov.ua/article/6282946

→https://cip.gov.ua/services/cm/api/attachment/download?id=71278

→https://cip.gov.ua/ua/news/novi-kiberzagrozi-kogo-i-yak-atakuyut-vorozhi-ugrupovannya

→https://securityaffairs.com/183222/apt/ukraine-sees-surge-in-ai-powered-cyberattacks-by-russia-linked-threat-actors.html

→https://socprime.com/blog/detect-uac-0226-attacks-against-ukraine/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.giftedcrook

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search GIFTEDCROOK