Attack Details
The attacks start with clever social engineering through Signal and WhatsApp. Hackers pretend to be legitimate humanitarian or charity groups, talking to targets in Ukrainian and showing knowledge about their work and organizations. Victims are convinced to click links to fake websites like harthulp-ua[.]com and solidarity-help[.]org that look like real aid organizations. These sites host password-protected file archives designed to avoid automated security scans and make victims more likely to open them manually.
After extraction, the archive contains a Windows program packaged with PyInstaller, a tool that bundles Python code into a standalone file. When run, this program installs the PLUGGYAPE backdoor. Newer versions of PLUGGYAPE include multiple tricks to hide itself and check if it’s running in a test environment like a sandbox or virtual machine. These protections prevent the malware from running during security analysis, making it harder for researchers to study.
PLUGGYAPE is written in Python and works as a full-featured remote access backdoor. It connects to attacker servers using either WebSocket or MQTT (Message Queuing Telemetry Transport) protocols. The use of MQTT, added in December 2025, is especially concerning because MQTT is a lightweight communication protocol mainly used for IoT devices and rarely monitored by enterprise security tools. This allows the malware to hide within normal network traffic while maintaining a steady connection with attackers. Through these connections, attackers can run commands, gather information about the system, and install additional malware on infected computers.
Instead of hardcoding server addresses in the malware, PLUGGYAPE downloads its command-and-control addresses from public paste sites like rentry[.]co and pastebin[.]com. These addresses are stored in Base64 encoding and decoded when needed. This approach makes the operation more flexible because attackers can change their infrastructure without updating the malware, and quickly regain control if their servers get blocked or shut down.
CERT-UA Report
CERT-UA stressed that the initial contact phase of these attacks closely resembles genuine human conversation. Attackers use real or stolen Ukrainian phone numbers, speak fluent Ukrainian, and may even make audio or video calls to appear legitimate. This level of personalization goes beyond typical phishing emails and shows how social engineering has become a primary attack method. According to the agency, mainstream messaging apps available on phones and computers have become the main way modern cyberattacks are delivered.
CERT-UA also reported on another threat group called UAC-0239. This group sent phishing emails from UKR[.]net and Gmail accounts with links to VHD (Virtual Hard Disk) files, either hosted online or attached directly. When these VHD files are opened, they run a Go-based data-stealing tool called FILEMESS, which searches for and steals files with specific extensions. The stolen data is sent to attacker-controlled Telegram channels, using Telegram’s encrypted messaging as an exfiltration route.
Victims of UAC-0239 also got infected with OrcaC2, an open-source command-and-control tool. OrcaC2 gives attackers various post-exploitation capabilities including interactive shell access, file transfers, keystroke recording, and remote command execution. While OrcaC2 is publicly available and often used for security testing, its use here shows the growing trend of weaponizing open-source hacking tools to speed up development and make attribution harder. This campaign mainly targeted Ukrainian defense organizations and local government offices.
CERT-UA also identified a separate phishing operation by UAC-0241 that targeted Ukrainian schools and government agencies. In this campaign, attackers sent ZIP files containing Windows shortcut (LNK) files. When opened, these shortcuts use mshta.exe to run an embedded HTML Application (HTA) file. The HTA runs JavaScript code that downloads and executes a PowerShell script, starting the final attack stage.
The PowerShell script installs LaZagne, a well-known open-source password recovery tool that can extract saved passwords from browsers, email programs, and system files. At the same time, a Go-based backdoor called GAMYBEAR is installed. GAMYBEAR uses HTTP to communicate with command-and-control servers, receives instructions from operators, runs commands on the infected computer, and sends back results in Base64 encoding. This combination enables both immediate password theft and long-term remote access.
These campaigns show a clear pattern: attackers combine social manipulation, flexible technology, and publicly available hacking tools to gain access while staying hidden. By using trusted messaging apps like Signal, WhatsApp, and Telegram, they avoid traditional email security systems and exploit communication channels that users naturally trust as safe and personal. Using open-source tools also makes their work faster and cheaper while making it harder to trace attacks back to them, since these same tools are commonly used for legitimate security testing.
The repeated targeting of Ukrainian defense, government, and schools indicates a long-term spying operation rather than random or money-driven attacks. The attackers focus on staying hidden, quickly switching their infrastructure when needed, and using adaptable command-and-control systems. Their heavy use of personalized conversations, fluent Ukrainian language, and detailed knowledge about targets shows that gaining human trust is their main entry point—the technical malware comes second, after they’ve already fooled someone into letting them in.