PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces

CERT-UA has disclosed details of new cyber attacks against Ukraine’s defence forces deploying malware known as PLUGGYAPE between October and December 2025, with the activity attributed to a Russian hacking group tracked as Void Blizzard (aka Laundry Bear or UAC-0190) and active since at least April 2024.

The attackers used instant messaging platforms Signal and WhatsApp, masquerading as charity organisations to lure targets with a seemingly harmless link purporting to be aid, such as harthulp-ua[.]com or solidarity-help[.]org, which downloads a password‑protected archive containing the PyInstaller‑built executable that deploys PLUGGYAPE.

CERT-UA notes that successive backdoor iterations add obfuscation and anti‑analysis checks to hinder execution in virtual environments, while the malware communicates with a remote server over WebSocket or MQTT, the latter added in December 2025. The threat actors retrieved C2 addresses from external paste services stored in Base64 to maintain operational security and resilience, allowing real‑time updates if the original infrastructure is detected and taken down.

Initial interactions with targets reportedly involve legitimate Ukrainian mobile operator accounts in Ukrainian, with language and contextual knowledge used to convince victims.