Home
Glossary
Hatvibe malware
Table of contents
5 min
H2 title on one or more lines.
Share
Updated on
June 22, 2026

HATVIBE malware

HATVIBE is a custom malware loader, built around VBScript and HTML application files, used in cyber espionage campaigns against government, diplomatic, and research organizations. First identified in 2023, it isn't the malware that does the damage. It's the first stage: it establishes a foothold on a compromised machine, reports basic information about it back to its operators, and downloads whatever they want to run next, most commonly a Python-based backdoor tracked as CHERRYSPY. It's associated with an espionage cluster tracked as UAC-0063 and TAG-110, assessed as Russia-aligned, whose reported targets sit mainly in Central Asia, Ukraine, and Europe. This page covers what HATVIBE does, who uses it and how confident to be about that, and what defenders can act on.

Key takeaways

  • HATVIBE is a loader, not a payload. Its job is to get a foothold and fetch the next stage, so finding it means something else probably followed.
  • It's built from scripting, not compiled code. VBScript and HTML application files, which means it arrives as text and can be obfuscated rather than packed.
  • It's paired with CHERRYSPY. The backdoor it most often delivers is where the actual espionage capability sits.
  • The link to a known actor is an assessment, not a confirmation. The cluster using it is assessed as Russia-aligned, and its suspected relationship to a larger group rests on overlapping targeting rather than technical proof.

What HATVIBE does

HATVIBE occupies a narrow, specific role in an intrusion, and understanding that role is most of what a defender needs from it.

HATVIBE execution stages
Stage What happens
Delivery Reported routes include malicious Microsoft Word attachments sent by spearphishing, and exploitation of vulnerable internet-facing servers.
Execution The loader runs as script rather than as a compiled program, using obfuscation to make its code harder to read and to get past basic inspection.
Reconnaissance and command and control It collects basic information about the machine, reports to a remote server, and waits for instructions. Its communications are encrypted, and it checks for signs of sandbox or virtual machine environments before proceeding.
Next stage It downloads and runs a further payload, most often the CHERRYSPY backdoor, which provides the persistent access and data theft the operation is actually after.

Two implications follow for a security team. Because the loader is script-based, detection that relies on recognizing executable files has less to work with, and controls around script execution matter more than usual. And because its purpose is to fetch something else, a HATVIBE detection should be treated as evidence of an intrusion in progress rather than an isolated find.

Who uses HATVIBE, and how confident to be

HATVIBE is associated with an espionage cluster tracked under two designations, UAC-0063 and TAG-110, which refer to the same activity. Reported targeting covers government agencies, diplomatic missions, and research institutions, concentrated in Central Asia and Ukraine with activity reaching into Europe. The cluster is assessed as Russia-aligned, and the objective is described as strategic intelligence collection.

It's worth being precise about the attribution, because it's weaker than it can appear when summarized. The cluster has been suspected of a relationship with a larger, well-known Russian state actor, but that suspicion rests principally on an overlap in who gets targeted rather than on shared code or infrastructure. Victimology overlap is among the softest forms of linkage available to an analyst: two groups pursuing the same intelligence requirement will naturally hit similar targets without necessarily being connected. So the honest formulation is that a relationship is suspected and unconfirmed, and this page won't state it more firmly than the evidence supports.

How to detect and defend against HATVIBE

Given how it arrives and what it's built from, a few controls do most of the work:

  1. Restrict script execution. Limiting or blocking the execution of scripting and HTML application files from user-writable locations removes the loader's main method of running.
  2. Harden document handling. Because delivery relies on weaponized documents, blocking or restricting active content in files arriving from outside the organization closes the common entry route.
  3. Patch internet-facing servers. Exploitation of exposed servers is a reported alternative route in, so prompt patching addresses the path that doesn't involve a user at all.
  4. Watch for the behaviour, not the file. Monitor for scripting hosts spawning from document applications, and for scripted processes making outbound connections shortly afterwards, which is the sequence that reveals a loader regardless of how its code is obfuscated.
  5. Treat a detection as an active intrusion. Investigate what was downloaded after the loader ran, look for the follow-on backdoor, and check for persistence rather than removing the loader and closing the case.

Why a loader is worth more attention than it looks

HATVIBE is unremarkable as software. It's a script that phones home and downloads something. Judged on its own, it barely merits a name. But a loader is a position in an operation rather than a capability, and its presence tells you that someone selected your organization, delivered something to it successfully, and had a follow-on payload ready. The interesting question is never what the loader did. It's what arrived after it.

That's the practical reason to care about a thinly documented malware family like this one. Sekoia is a European cybersecurity vendor, and detection on its AI SOC platform rests on behaviour correlated across endpoint, network, and identity signals and mapped to the MITRE ATT&CK framework, with cyber threat intelligence produced by an in-house Threat Detection & Research (TDR) team. For a script-based loader that can be rewritten easily, that behavioural layer is what remains useful: a document spawning a scripting host, a script reaching an unfamiliar server, a new payload appearing shortly after. Those steps stay recognizable even when the file that performed them is new.