cert-ua has disclosed that there is a cyberespionage campaign against the Ukrainian military that ran from October to December 2025, with a distinct malware called "pluggy ape" which has not been documented before.
it has been assessed with medium confidence that the known threat actor "void blizzard" (a.k.a. laundry bear/UAC-0190) based out of russia, has been estimated to be active since at least April 2024.
Unconventional Vector for Malware Distribution
instead of using traditional email phishing methods, this group utilized messaging applications such as signal and WhatsApp as their primary channels for delivering malicious content.
The threat actors imitated established charity organizations to lure in victims through authentic-seeming conversations and then diverted them from legitimate sites to the following fake urls where they were encouraged to download password protected zip or archive files purportedly containing humanitarian or relief material.
PLUGGYAPE Capabilities and Deployment
Installing PLUGGYAPE requires the download of an archive containing a PyInstaller-packaged executable file, which can be run to install and execute the PLUGGYAPE malware created with Python programming language.
According to CERT-UA, the latest versions of PLUGGYAPE include code obfuscation and a number of other features that include anti-analysis functions that are meant to stop the backdoor from running in a virtual or sandboxed environment.
Once the backdoor has been installed and started, the malicious software establishes a C2 (command and control) channel using:
1. WebSockets
2. MQTT or message queue telemetry transport, which was added in December 2025
This will allow the end user to execute arbitrary code on the computer that has been infected.
PLUGGYAPE Command and Control Structure
Instead of embedding the command and control addresses into the PLUGGYAPE executable, the malware retrieves the addresses dynamically from third-party service providers:
1. rentry[.]co
2. pastebin[.]com
C2 addresses are stored in Base64 coded format so that the operator can rotate C2 infrastructure in real-time and maintain resilience if the server is found or goes down.
CERT-UA also stated that the attackers increasingly rely on actual mobile numbers registered to Ukrainian mobile service providers along with fluent Ukrainian language skills and knowledge about potential victims to gain confidence and evade detection.
"C2 channels and malware delivery vehicles are now predominately delivered through widely used mobile device messenger applications and social network platforms, as they have become the primary method for spreading cyber threats," are according to CERT-UA.
Focus on Ukraine Related Campaigns
CERT-UA creatively identified other threat clusters, including:
1. UAC-0239: a campaign that uses phishing emails with VHD attachments to send out the FILEMESS infostealer, which exfiltrates data to Telegram and installs a Go-based C2 called OrcaC2.
2. UAC-0241: A campaign that targets educational institutions and government entities by sending malicious ZIP files with LNK files that lead to the installation of LaZagne and a Go-based RAT called GAMYBEAR.
This type of activity is representative of an increase in multi-vector espionage against Ukrainian Defense Forces, Government and Public Sector organizations.
Source: The Hacker News
