CERT-UA reports PLUGGYAPE cyberattacks on defense forces

Key Points:

• PLUGGYAPE malware attacks have been reported against Ukraine's defense forces, attributed to the Russian-linked Void Blizzard group.
• The attack utilizes social engineering tactics via instant messaging to deliver malicious executables disguised as documents, leading to remote access via the PLUGGYAPE backdoor.
• Recommended actions include enhancing user awareness training on social engineering, implementing strict controls on executable file downloads, and monitoring for unusual registry changes.

Technical Details: The PLUGGYAPE malware is delivered through deceptive means, such as fake charitable websites and misleading file extensions. It is packaged with PyInstaller and communicates using MQTT or WebSockets, maintaining persistence by modifying the system's Run registry key.

MITRE ATT&CK Techniques:

• T1566 - Phishing (Initial Access)
• T1203 - User Execution (Execution)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys (Persistence)

IOCs Mentioned: None mentioned