CERT-UA reports PLUGGYAPE cyberattacks on defense forces

CERT-UA reported that PLUGGYAPE malware was used in attacks against Ukraine’s defence forces, with medium confidence attribution to the Russia-linked Void Blizzard group. The infection chain begins with social engineering, as attackers contact targets through instant messaging apps and direct them to a fake charitable foundation website to download supposed documents. These files are delivered in password-protected archives or sent via chat, often with extensions such as “.docx[.]pif” to appear harmless.

When opened, a Python-based program packaged with PyInstaller runs, installing the PLUGGYAPE backdoor that provides attackers with remote access to the infected system. Later variants evolved to use MQTT for communication and added anti-analysis checks, including VM detection, with some C2 details hidden on public sites and encoded.

From December 2025, an obfuscated PLUGGYAPE.V2 variant surfaced, continuing to exchange data in JSON over WebSockets or MQTT and to collect system identifiers to generate a unique device ID using SHA-256. According to CERT-UA, the initial access increasingly leverages legitimate accounts and Ukrainian-language communications, using popular instant messengers as the delivery channel for cyberthreats.