PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

"The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of new cyber attacks targeting its defense forces with malware known as PLUGGYAPE between October and December 2025. The activity has been attributed with medium confidence to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190). The threat actor is believed to be active since at least April 2024."

"Attack chains distributing the malware leverage instant messaging Signal and WhatsApp as vectors, with the threat actors masquerading as charity organizations to convince targets into clicking on a seemingly-harmless link ("harthulp-ua[.]com" or "solidarity-help[.]org") impersonating the foundation and download a password-protected archive. The archives contain an executable created with PyInstaller that ultimately led to the deployment of PLUGGYAPE. CERT-UA said successive iterations of the backdoor have added obfuscation and anti-analysis checks to prevent the artifacts from being executed in a virtual environment."

"Written in Python, PLUGGYAPE establishes communication with a remote server over WebSocket or Message Queuing Telemetry Transport (MQTT), allowing the operators to execute arbitrary code on compromised hosts. Support for communication using the MQTT protocol was added in December 2025. In addition, the command-and-control (C2) addresses are retrieved from external paste services such as rentry[.]co and pastebin[.]com, where they are stored in base64-encoded form, as opposed to directly hard-coding the domain in the malware itself."

The Computer Emergency Response Team of Ukraine (CERT-UA) disclosed new cyber attacks targeting defense forces using PLUGGYAPE between October and December 2025. The activity is attributed with medium confidence to Russian hacking group Void Blizzard (aka Laundry Bear or UAC-0190), active since at least April 2024. Attack chains use Signal and WhatsApp, masquerading as charity organizations and sending links to password-protected archives. The archives contain PyInstaller executables that deploy a Python backdoor. PLUGGYAPE communicates over WebSocket and, since December 2025, MQTT. C2 addresses are fetched from external paste services in base64 to enable flexible updates. Successive backdoor versions add obfuscation and anti-analysis checks.

Read at The Hacker News