Uploaded November 2024 | Updated September 2026, 4 days ago

---

Russian group UNC5812 has launched a hybrid malware campaign targeting Ukrainian military recruits via fake "Civil Defense" identities and Telegram channels, deploying platform-specific malware on Windows and Android.

Windows malware includes Pronsis Loader and PureStealer, while Android uses CraxsRAT to steal data and spy on users. The campaign uses fake recruitment apps to trick users into downloading malicious software.

The campaign undermines Ukrainian military efforts by sowing distrust and stealing sensitive information.

More on Bleepingcomputer: bleepingcomputer.com/news/security/russia-targets-ukrainian-conscripts-with-windows-android-malware

Follow me:
Mastodon: https://infosec.exchange/@skickar

Thanks to our sponsor Varonis ⬇️
LinkedIn: / varonis
Visit our website: varonis.com/kody