Kremlin-linked hackers pose as charities to spy on Ukraine’s military

CERT-UA reported that Kremlin-linked APT Void Blizzard (also tracked as Laundry Bear / UAC-0190) ran a targeted cyber-espionage campaign from October–December 2025 against Ukrainian military personnel, using a new backdoor called PluggyApe. Attackers posed as charitable organizations and used messaging apps (Signal, WhatsApp) and password‑protected archives to deliver malicious executables, then upgraded the malware to add persistence and anti-analysis features while leveraging legitimate accounts and localized, highly tailored lures.