PLUGGYAPE Malware Targets Ukrainian Defense Forces via Signal and WhatsApp

The Ukrainian Computer Emergency Response Team (CERT-UA) disclosed details of cyber attacks involving PLUGGYAPE malware targeting its defense forces from October to December 2025. This malware is linked to the Russian hacking group Void Blizzard, also known as Laundry Bear or UAC-0190, which has been active since at least April 2024. Attackers used instant messaging platforms Signal and WhatsApp, impersonating charity organizations to lure victims into clicking on malicious links.

Upon clicking, users downloaded a password-protected archive containing an executable created with PyInstaller, leading to the deployment of PLUGGYAPE. CERT-UA noted that the malware has evolved to include obfuscation and anti-analysis measures, making it harder to detect in virtual environments. The malware establishes communication with a remote server using WebSocket or Message Queuing Telemetry Transport (MQTT), enabling attackers to execute arbitrary code on compromised hosts.

In December 2025, support for MQTT communication was added, enhancing the malware’s capabilities. The command-and-control (C2) addresses are retrieved from external paste services like rentry.co and pastebin.com, stored in base64-encoded form, which helps maintain operational security for the attackers. This method allows them to update C2 servers in real-time if their original infrastructure is compromised.

CERT-UA highlighted that initial interactions with targets increasingly use legitimate accounts and phone numbers of Ukrainian mobile operators, often in the Ukrainian language. Attackers may demonstrate detailed knowledge about their targets, making these attacks particularly deceptive.

In addition to PLUGGYAPE, CERT-UA reported other threats targeting Ukrainian defense forces and local governments. For instance, a threat cluster known as UAC-0239 sent phishing emails from UKR.net and Gmail addresses, leading to a Go-based stealer named FILEMESS that exfiltrates files to Telegram. Another group, UAC-0241, executed spear-phishing campaigns using ZIP archives containing Windows shortcut files that trigger malicious scripts.

Implications for Cybersecurity

The use of widely available messaging platforms for malware distribution highlights a growing trend in cyber threats. Users and organizations should be vigilant about unsolicited messages, especially those claiming to be from charitable organizations. The sophistication of these attacks, including the use of legitimate accounts and targeted knowledge, underscores the need for enhanced security measures.

Organizations should implement strict verification processes for communications, especially those involving sensitive information or links. Regular training on recognizing phishing attempts and suspicious communications can help mitigate risks. Additionally, monitoring for unusual activities on devices and networks is crucial to detect potential breaches early.