How Cybercriminals Exploit Trusted Authorities — And How to Share Files Without Falling Victim

In a chilling reminder of how deeply cybercriminals will go to gain trust, the Computer Emergency Response Team of Ukraine (CERT-UA) was recently impersonated in a large-scale phishing campaign that delivered the AGEWHEEZE remote access trojan (RAT) to over a million inboxes. The attack, attributed to threat actor group UAC-0255, used the credibility of a national cybersecurity authority to lure victims into opening malicious attachments disguised as urgent security advisories. This isn't just another phishing story—it's a wake-up call about how trust is weaponized in digital attacks and why secure file sharing must evolve beyond email.

The Anatomy of a Trusted Authority Impersonation

On March 26 and 27, 2026, thousands of individuals and organizations across Ukraine and neighboring regions received emails that appeared to originate from CERT-UA, Ukraine’s official incident response team. The messages referenced critical cybersecurity vulnerabilities and urged recipients to review attached documentation. The attachments? Password-protected ZIP files containing the AGEWHEEZE malware.

Why did this work? Because CERT-UA is a trusted entity. When an organization responsible for defending national cyber infrastructure is impersonated, recipients are far more likely to bypass their usual skepticism. The password protection added a layer of perceived legitimacy—many users assumed the password would be provided in a follow-up email, a common practice for secure document sharing.

This is social engineering at its most insidious. The attackers didn’t rely on technical exploits alone; they exploited human psychology, leveraging urgency, authority, and familiarity to bypass defenses. Once executed, AGEWHEEZE granted attackers full remote control over infected systems, enabling data theft, surveillance, and lateral movement across networks.

Why Email is Inherently Insecure

This campaign underscores a fundamental flaw in how most organizations share files: reliance on email. Despite decades of warnings, email remains the primary vector for malware distribution. It’s convenient, universal, and—critically—deeply unsecure.

Consider the vulnerabilities:

• No built-in encryption: Standard email travels in plain text, exposed to interception at multiple points.
• Easy to spoof: Display names and sender addresses can be faked with minimal effort.
• Attachments are blind drops: Users can’t verify the integrity or safety of a file before downloading.
• Phishing fatigue: Even trained users struggle to distinguish legitimate messages from sophisticated spoofs.

In the CERT-UA case, the password-protected archive was especially dangerous because it evaded many email security filters. Password-protected files can’t be scanned by antivirus engines, allowing malware to slip through undetected. The password itself was either sent later or promised in a trusted context—further eroding user caution.

The Rise of Impersonation Attacks

Impersonation attacks are on the rise. According to recent threat intelligence reports, 75% of breaches in 2025 involved some form of social engineering, with impersonation of trusted brands, government agencies, or executives being the most effective tactic. Cybercriminals aren’t just targeting individuals—they’re weaponizing trust at scale.

What makes these attacks so effective?

• Authority bias: People are conditioned to comply with official-looking messages from authoritative sources.
• Information urgency: Warnings about vulnerabilities create fear, prompting rapid action without verification.
• Brand mimicry: Attackers replicate logos, email signatures, and language with near-perfect accuracy.

The CERT-UA campaign shows that no organization—no matter how security-focused—is immune to being impersonated. If a national cybersecurity team can be spoofed, so can your IT department, your vendor, or your bank.

A Better Way to Share Files: Security by Design

So how do we break this cycle? The answer lies in moving away from email-based file sharing and adopting platforms built with privacy and verification at their core.

At FileShot.io, we believe secure file transfer shouldn’t depend on the user’s ability to spot a spoofed email. Instead, security should be automatic, invisible, and unavoidable. That’s why every file shared through FileShot uses end-to-end encryption—meaning your files can’t be accessed even by our servers. Once uploaded, they’re encrypted client-side, and only the recipient receives the decryption key via a separate, secure channel.

But encryption is just the beginning. FileShot also eliminates the risks of impersonation by removing email as the primary delivery method. Instead of receiving a suspicious attachment, users get a secure link to a clean, branded portal where they can verify the sender’s identity, view file metadata, and download content in a sandboxed environment. No more blind ZIP files. No more guessing games.

Best Practices for Secure File Sharing

While tools like FileShot provide a strong technical foundation, vigilance is still required. Here are essential practices to adopt:

• Never open unsolicited attachments: Even if they appear to come from a trusted source, verify through a separate channel.
• Enable multi-factor authentication (MFA): Especially for email and cloud storage accounts.
• Use domain-based message authentication: Implement SPF, DKIM, and DMARC to reduce email spoofing.
• Train teams regularly: Conduct phishing simulations and update training based on current threats.
• Adopt verified file-sharing platforms: Replace email attachments with secure, encrypted alternatives that provide sender verification and audit trails.

The CERT-UA incident isn’t just a Ukrainian issue—it’s a global warning. As cybercriminals grow more sophisticated in their impersonation tactics, our response must be equally advanced. We can’t rely on users to be perfect. Instead, we must build systems where security is the default, not the exception.

FileShot uses end-to-end encryption so your files can't be accessed even by our servers, and every transfer includes identity verification to prevent impersonation. In a world where even cybersecurity agencies can be faked, trust should never be assumed—it should be verified, encrypted, and protected by design.

Sorry, we couldn't load this post. Please go back to the blog index.