--- title: PLUGGYAPE Malware Uses Signal and WhatsApp to Target... description: CERT-UA identified PLUGGYAPE malware attacks targeting Ukrainian defense forces between October and December 2025, attributed to Russian group Void Blizzard.... canonical: https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces | daily.dev og:description: CERT-UA identified PLUGGYAPE malware attacks targeting Ukrainian defense forces between October and December 2025, attributed to Russian group Void Blizzard.... og:url: https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u og:image: https://api.daily.dev/og/posts/YEhcHHF9u.png og:image:alt: PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces **[The Hacker News](https://daily.dev/sources/thn)** · 3 min read · 0 upvotes · 0 comments ## Summary CERT-UA identified PLUGGYAPE malware attacks targeting Ukrainian defense forces between October and December 2025, attributed to Russian group Void Blizzard. Attackers used Signal and WhatsApp to distribute phishing links disguised as charity organizations, delivering Python-based backdoors with WebSocket/MQTT communication. The malware retrieves C2 addresses from paste services like Pastebin for operational resilience. Additional campaigns deployed FILEMESS stealer via VHD files and GAMYBEAR backdoor through LNK/HTA payloads, targeting defense forces, local governments, and educational institutions. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Russia-Aligned Hackers Abuse Viber to Target Ukrainian Military and Government](https://daily.dev/posts/russia-aligned-hackers-abuse-viber-to-target-ukrainian-military-and-government-y6hqvw4un) · The Hacker News · 0 upvotes · 0 comments - [From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine](https://daily.dev/posts/from-phishing-to-malware-ai-becomes-russia-s-new-cyber-weapon-in-war-on-ukraine-jdqsub135) · The Hacker News · 0 upvotes · 0 comments - [Ukraine Aid Groups Targeted Through Fake Zoom Meetings and Weaponized PDF Files](https://daily.dev/posts/ukraine-aid-groups-targeted-through-fake-zoom-meetings-and-weaponized-pdf-files-kos2wvbcm) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces","url":"https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u"},"datePublished":"2026-01-14T07:03:05.188Z","dateModified":"2026-01-14T07:03:27.178Z","description":"CERT-UA identified PLUGGYAPE malware attacks targeting Ukrainian defense forces between October and December 2025, attributed to Russian group Void Blizzard....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a8335748dd483cc9104baaa25c8e4a8?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5a8335748dd483cc9104baaa25c8e4a8?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/pluggyape-malware-uses-signal-and-whatsapp-to-target-ukrainian-defense-forces-yehchhf9u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,malware,phishing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces"}]} ```