Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs

According to CERT-UA, Ukraine’s Computer Emergency Response Team, a new targeted campaign has been observed in September 2025 using a backdoor named CABINETRAT, attributed to a threat cluster it tracks as UAC-0245. The attackers have been distributing XLL add-ins for Microsoft Excel inside ZIP archives shared over the Signal messaging app, disguised as documents about border detentions.

When run, the XLL loads a backdoor designed to create multiple executables on the host, including an EXE in Startup, an XLL named BasicExcelMath[.]xll in AppData, and a PNG image, with registry changes to secure persistence and the Excel process launched in hidden mode to activate the XLL. The payload is able to collect system information, enumerate installed programs, take screenshots, list directories, delete files, execute commands, and perform file uploads/downloads, communicating with a remote server over TCP.

Fortinet FortiGuard Labs had warned of attacks targeting Ukraine days earlier, including impersonations of the National Police of Ukraine in a phishing campaign.