Follow us on Google News
Ukrainian defence officials were targeted in a new cyber espionage campaign that used the guise of charitable activity to distribute malicious software, Ukraine’s Computer Emergency Response Team (CERT-UA) has said. The campaign, active between October and December 2025, deployed a backdoor malware known as PluggyApe, allowing attackers covert access to compromised systems.
According to CERT-UA, the operation is likely linked to Russia-aligned threat actors, commonly tracked as “Void Blizzard” and “Laundry Bear”, though the agency noted that attribution remains at a medium confidence level.
Certified Cyber Crime Investigator Course Launched by Centre for Police Technology
Group linked to earlier NATO-focused cyber intrusions
Laundry Bear is the same cyber group previously accused of breaching internal systems of the Dutch police in 2024, resulting in the theft of sensitive personnel data. Cybersecurity agencies have long tracked the group for targeting NATO member states, with operations designed to steal files, emails and strategic intelligence aligned with Russian geopolitical interests.
The latest campaign appears to follow a similar intelligence-gathering pattern, but with increasingly refined social engineering techniques.
Attacks initiated via Signal and WhatsApp
CERT-UA said the attacks typically began with direct messages sent over Signal or WhatsApp, where recipients were encouraged to visit websites purportedly operated by charitable foundations. Victims were then prompted to download a password-protected archive, allegedly containing documents relevant to humanitarian or defence-related causes.
In reality, the archives concealed executable files disguised with extensions such as “.docx.pif”, which installed the PluggyApe malware once opened. In several instances, the malicious payload was delivered directly through messaging platforms, bypassing email-based security controls.
Malware built using PyInstaller, achieves system persistence
The malware was created using PyInstaller, an open-source tool commonly used to package Python applications into standalone executables. Once installed, PluggyApe profiles the infected device, exfiltrates system and user data to the attackers, and remains dormant while awaiting remote execution commands.
CERT-UA said the malware achieves persistence by modifying Windows Registry entries, allowing it to survive system reboots and evade basic detection mechanisms.
Shift in tactics observed in December 2025
Earlier versions of PluggyApe relied on deceptive file names such as “.pdf.exe” to trick users into execution. However, by December 2025, attackers shifted to PIF file formats and deployed PluggyApe version 2, which features enhanced code obfuscation, MQTT-based command-and-control communication, and advanced anti-analysis checks.
The newer variant also avoids hardcoding command-and-control (C2) server addresses. Instead, it dynamically retrieves them from external platforms such as rentry.co and pastebin.com, where the data is published in base64-encoded form, making detection and takedown efforts more difficult.
Mobile devices increasingly targeted
CERT-UA warned that mobile phones have emerged as high-value targets in such campaigns, as they are often less protected and insufficiently monitored compared to enterprise systems. The attackers reportedly used compromised accounts, phone numbers associated with Ukrainian telecom operators, and communication conducted entirely in the Ukrainian language, including audio and video calls.
“These interactions are designed to appear legitimate and personalised,” CERT-UA noted, adding that attackers often demonstrate detailed knowledge of the victim, their organisation, and operational context, significantly increasing the success rate of the deception.
Advisory issued to defence and government bodies
The Ukrainian cyber agency has urged defence personnel and government institutions to exercise heightened caution when dealing with unsolicited charity-related messages, unfamiliar links, or password-protected file downloads. A detailed list of Indicators of Compromise (IoCs), including malicious domains posing as donation portals, has been published to aid early detection.
The campaign underscores how modern cyber warfare increasingly exploits humanitarian narratives to bypass suspicion and penetrate sensitive networks. Security officials say the episode reinforces the need to treat digital resilience as a core component of national defence, particularly amid prolonged geopolitical conflict.
About the author – Ayesha Aayat is a law student and contributor covering cybercrime, online frauds, and digital safety concerns. Her writing aims to raise awareness about evolving cyber threats and legal responses.
