Hive0156, also known as UAC-0184, is a Russia-linked advanced persistent threat (APT) group that emerged in late 2023. This actor primarily engages in cyber espionage and intelligence gathering operations, consistently targeting Ukrainian military and government entities. The group is distinguished by its persistent targeting patterns, its use of the commercial Remcos Remote Access Trojan, and sophisticated delivery methods involving the IDAT Loader (also known as HijackLoader) which often employs steganography. Hive0156 utilizes Ukrainian-language lures and themes relevant to local interests or current events to enhance the effectiveness of its social engineering campaigns, demonstrating a dedicated geopolitical focus on Ukraine.