A ZIP archive impersonating wartime asset disclosure paperwork delivers a two-stage LNK→PowerShell downloader to Ukrainian targets — with a geo-fenced C2 that returns 403 to every sandbox that tries to fetch the payload.
grep -rl "uac-0010" ./posts
#uac-0010
1 match