CERT-UA reports PLUGGYAPE cyberattacks on defense forces

CERT-UA reported targeted PLUGGYAPE backdoor campaigns against Ukraine’s defense forces, attributed with medium confidence to the Russia-linked Void Blizzard (Laundry Bear). Attackers used social engineering over instant messaging to trick victims into running PyInstaller-packaged Python executables (often inside password-protected archives or with misleading extensions) that install a Python-based backdoor which communicates via WebSockets or MQTT, executes server-sent code, collects system identifiers, persists via the Run registry, employs anti-analysis checks (VM detection), and hides C2 details on public paste sites; the report also references a related 2024 Dutch police data breach linked to the same actor.