Updated on
June 22, 2026
Hatvibe malware
Hatvibe is a custom loader written in VBScript, first identified in 2023 and used by the threat actor UAC-0063, suspected to be linked to APT28 based on victimology overlap.
It is used by the threat actor UAC-0063 (suspected to be linked to APT28 / Fancy Bear based on victimology overlap).
Hatvibe functions as a first-stage payload. Its primary role is to load and execute additional malicious modules on the infected system. The malware uses AES encryption for its communication and has anti-analysis features such as checks for sandbox environments and virtual machines.
More technical details about this loader and its use in campaigns targeting Central Asian entities can be found on Malpedia.
