PLUGGYAPE Malware Campaign Targeting Ukrainian Defense Forces

PLUGGYAPE Ukraine Defense Targeting Social Engineering Python Backdoor CERT-UA#19092

Overview

PLUGGYAPE is a Python-based backdoor malware deployed in a sophisticated social engineering campaign targeting Ukrainian defense forces personnel. Documented by CERT-UA (Ukraine Computer Emergency Response Team) as incident #19092, the campaign leverages instant messaging applications (Signal, WhatsApp) to establish trust with victims by impersonating charitable foundations providing aid to Ukraine.

Attackers contact defense personnel via these encrypted messaging platforms, build rapport by discussing humanitarian assistance, and eventually persuade targets to visit fake charity websites where they download malicious executables disguised as benign documents (donation forms, aid applications, informational PDFs).

The malware, distributed as PyInstaller-packaged executables with deceptive file extensions (.pdf.exe, .docx.pif), deploys the PLUGGYAPE backdoor upon execution, establishing persistent remote access to compromised systems. The backdoor communicates with command-and-control (C2) infrastructure via WebSocket or MQTT protocols, with C2 addresses dynamically retrieved from public paste services (Pastebin, rentry.co) encoded in base64—enabling attackers to rapidly change infrastructure and evade detection.

PLUGGYAPE maintains persistence through Windows Registry Run keys and includes anti-analysis features to detect virtual environments and sandbox execution. The campaign represents a significant operational security threat to Ukrainian defense capabilities, potentially enabling espionage, intelligence gathering, operational disruption, and compromise of sensitive military communications.

---

Campaign Specifications

Attribute	Details
Malware Name	PLUGGYAPE
Campaign ID	CERT-UA#19092
Threat Actor	Unknown (suspected state-sponsored or Russian-aligned group)
Target	Ukrainian defense forces personnel
Target Geography	Ukraine
Campaign Timeline	Active as of January 2026 (ongoing)
Initial Contact Vector	Social engineering via Signal and WhatsApp
Social Engineering Theme	Fake charitable foundations offering humanitarian aid to Ukraine
Delivery Mechanism	Fake websites hosting malicious executables disguised as documents
Malware Type	Python-based backdoor (remote access trojan)
Packaging	PyInstaller executables
File Disguises	.pdf.exe (early versions), .docx.pif (later versions)
Persistence Method	Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run)
C2 Protocol	WebSocket or MQTT
C2 Infrastructure	Dynamic addresses retrieved from public paste services (Pastebin, rentry.co)
C2 Encoding	Base64-encoded URLs
Anti-Analysis	Virtual environment detection, sandbox evasion
Capabilities	Remote command execution, data exfiltration, system reconnaissance
Operational Impact	Espionage, intelligence theft, operational security degradation
Attribution Confidence	Low (no confirmed threat actor, suspected Russian nexus based on targets)
Discovery Source	CERT-UA (Ukraine Computer Emergency Response Team)
Public Disclosure	January 2026

---

Technical Details

Malware: PLUGGYAPE Python Backdoor

Architecture:

• Language: Python (packaged via PyInstaller for Windows distribution)
• Delivery: Standalone executable (no Python installation required on victim)
• Size: Typically 10-20 MB (includes Python runtime and dependencies)

File Naming Conventions:

Early versions:

donation_form.pdf.exe
humanitarian_aid_application.pdf.exe
charity_registration.pdf.exe

Later versions (improved disguise):

ukraine_assistance_info.docx.pif
aid_program_details.docx.pif
volunteer_registration.docx.pif

PIF Extension: .pif files are Windows Program Information Files historically used for MS-DOS shortcuts, but Windows executes them as executables—victims see Word icon and assume it's a document.

Infection Chain

1. Social Engineering (Signal/WhatsApp)
   Attacker poses as charity representative → Builds trust over days/weeks

2. Malicious Link Distribution
   Victim receives link to fake charity website (e.g., harthulp-ua[.]com)

3. Fake Document Download
   Website offers "information packet" or "application form" as download
   File appears as document (Word icon, PDF icon) but is executable

4. Execution
   Victim double-clicks → Windows executes PyInstaller-packaged Python code

5. PLUGGYAPE Installation
   Malware extracts to user directory, adds Registry persistence

6. C2 Connection
   Retrieves C2 address from Pastebin → Connects via WebSocket/MQTT

7. Backdoor Active
   Attacker has remote access for commands, file exfiltration, reconnaissance

Persistence Mechanism

Registry Run Key:

PLUGGYAPE adds itself to Windows startup by modifying the Registry Run key. The malware registers an entry named "SystemUpdate" pointing to its executable location (typically in AppData\Local\Temp\svchost.exe). This ensures the backdoor executes automatically whenever the user logs in, surviving system reboots and maintaining persistent access for the attacker.

Command & Control (C2) Infrastructure

Dynamic C2 Resolution:

PLUGGYAPE uses a sophisticated infrastructure resilience mechanism by retrieving C2 server addresses from public paste services (Pastebin, rentry.co). The malware fetches a paste containing base64-encoded WebSocket or MQTT URLs. When decoded, these reveal the active C2 server address (e.g., wss://backup-c2-server[.]com:8443). If the paste service request fails, the malware falls back to hardcoded backup C2 addresses embedded in the binary.

Benefits for Attacker:

• Resilient: If C2 server taken down, simply update paste with new address
• Evasive: Paste services (Pastebin, rentry.co) are legitimate sites, bypass reputation filters
• Flexible: No need to recompile malware or redeploy to victims for infrastructure changes

C2 Protocols:

1. WebSocket (wss://):

   • Persistent bidirectional connection over HTTPS
   • Blends with normal web traffic
   • Real-time command execution

2. MQTT (Message Queuing Telemetry Transport):

   • Lightweight pub/sub protocol
   • Common in IoT, less suspicious than custom protocols
   • Efficient for low-bandwidth C2

Benefits for Attacker:

• Resilient: If C2 server taken down, simply update paste with new address
• Evasive: Paste services (Pastebin, rentry.co) are legitimate sites, bypass reputation filters
• Flexible: No need to recompile malware or redeploy to victims for infrastructure changes

C2 Protocols:

1. WebSocket (wss://):

   • Persistent bidirectional connection over HTTPS
   • Blends with normal web traffic
   • Real-time command execution

2. MQTT (Message Queuing Telemetry Transport):

   • Lightweight pub/sub protocol
   • Common in IoT, less suspicious than custom protocols
   • Efficient for low-bandwidth C2

Capabilities

Remote Commands:

• Execute arbitrary shell commands (cmd.exe, PowerShell)
• Upload/download files
• Capture screenshots
• Enumerate system information (OS version, installed software, network config)
• Harvest credentials (browser saved passwords, Windows Credential Manager)
• Keylogging (monitor typed passwords, communications)

Anti-Analysis Features:

• Virtual Machine Detection: Checks for VM-specific drivers (VMware, VirtualBox) and exits if detected
• Sandbox Evasion: Identifies common sandbox usernames (sandbox, malware, virus, sample) and terminates execution
• Resource Profiling: Analyzes CPU count (sandboxes typically allocate 1-2 cores) to avoid analysis environments
• Silent Failure: If analysis environment detected, malware exits without installing backdoor or generating alerts

Attack Scenario

Social Engineering Campaign Against Ukrainian Officer

1. Target Identification
Attacker identifies Ukrainian defense personnel via open-source intelligence (social media, professional networks) and obtains contact information through Signal/WhatsApp.

2. Initial Contact
Attacker poses as humanitarian worker from fake charity organization, initiates conversation via encrypted messaging app, and builds trust over several days by discussing legitimate aid topics.

3. Malicious Link Distribution
After establishing rapport, attacker directs victim to fake charity website (harthulp-ua[.]com) to "complete aid application" by downloading a form.

4. Malicious Download
Victim visits weaponized website and downloads file appearing as document (Aid_Application_Form.docx.pif) with Microsoft Word icon, but actually an executable.

5. Malware Execution
Victim double-clicks file. Windows executes the PyInstaller-packaged PLUGGYAPE backdoor, which:

- Creates Registry persistence
- Retrieves C2 address from Pastebin (base64-encoded)
- Establishes WebSocket connection to attacker's server
- No visible window opens; victim assumes file is corrupted

6. Backdoor Active
Attacker gains persistent remote access and conducts reconnaissance, harvesting system information, credentials, and files.

7. Intelligence Collection
Over subsequent days/weeks, attacker exfiltrates sensitive military documents, communications, and operational intelligence for espionage purposes.

---

Impact Assessment

ConfidentialityIntegrityAvailabilityScope

Exposure of sensitive military intelligence:

• Operational Plans: Unit movements, logistics, supply routes
• Personnel Information: Rosters, contact details, command structure
• Communications: Signal/WhatsApp messages, military emails
• Strategic Intelligence: Defense capabilities, equipment inventory, readiness assessments
• Classified Documents: Reports, briefings, tactical information

Potential for data manipulation:

• Document Tampering: Attacker could modify files on compromised systems (misinformation)
• Communication Interception: MITM attacks on military communications
• Trust Erosion: Victims lose confidence in secure messaging platforms

Limited direct disruption:

• Resource Consumption: Malware uses CPU/network bandwidth (minimal impact)
• Potential Sabotage: Could deploy wiper malware or ransomware in future (not observed yet)

Campaign targets military personnel:

• Primary Targets: Ukrainian Armed Forces officers and enlisted personnel
• Geographic Focus: Ukraine (active combat zones, rear support units, command centers)
• Strategic Objective: Undermine Ukrainian defense capabilities via espionage
• Broader Implications: Sets precedent for social engineering in conflict zones

---

Mitigation Strategies

User Awareness & Training

• Recognize Social Engineering: Train personnel to identify manipulation tactics:

  Warning Signs:
  - Unsolicited messages from "charities" or "aid organizations"
  - Requests to download files from unfamiliar websites
  - Urgent language pressuring immediate action
  - Links to domains mimicking legitimate organizations (harthulp-ua vs. legitimate-charity)
  - Documents with double extensions (.pdf.exe, .docx.pif)
  

• Verification Procedures: Establish out-of-band confirmation:

  Protocol:
  1. If contacted via Signal/WhatsApp about aid/donations, DO NOT click links
  2. Verify sender via independent channel (phone call, official website contact)
  3. Report suspicious contacts to unit security officer
  4. Never download files from unknown sources, even if sender seems legitimate
  

Technical Controls

• Endpoint Protection: Deploy advanced security tools:

  - EDR/XDR solutions detecting PyInstaller executables
  - Behavioral analysis for registry persistence attempts
  - Network monitoring for WebSocket/MQTT to unusual destinations
  - Application whitelisting (only allow approved executables)
  

• Network Filtering: Block malicious infrastructure:

  Blocklist (DNS/firewall):
  - harthulp-ua[.]com
  - solidarity-help[.]org
  - ua-aid[.]org
  - backup-server1.ua-aid[.]org
  
  Monitor connections to:
  - Pastebin.com, rentry.co (paste services used for C2 resolution)
  - Unusual WebSocket (wss://) connections on non-standard ports
  - MQTT traffic (ports 1883, 8883) to external servers
  

• File Extension Blocking: Prevent execution of disguised executables:

  Group Policy / Email Gateway:
  - Block .pif files (legacy format, rarely legitimate)
  - Block double extensions (.pdf.exe, .docx.exe)
  - Quarantine PyInstaller executables (detect via signature)
  

Detection & Monitoring

• Registry Monitoring: Alert on persistence mechanisms by monitoring Registry Run keys for new entries, particularly those pointing to suspicious locations like AppData, Temp directories, or masquerading as system processes (svchost). Configure security tools to detect unauthorized modifications to autostart registry locations.

• Network Anomaly Detection: Identify C2 communication:

  SIEM Rules:
  - Alert on outbound WebSocket connections to non-corporate domains
  - Flag connections to paste services (Pastebin, rentry.co) from non-developer systems
  - Detect base64-encoded traffic in HTTP requests
  - Monitor for MQTT protocol usage (uncommon on standard workstations)
  

---

Resources

Security Advisories & News

• CERT-UA reports PLUGGYAPE cyberattacks on defense forces
• PLUGGYAPE Malware Uses Signal and WhatsApp to Target Ukrainian Defense Forces
• CERT-UA reports PLUGGYAPE cyberattacks on defense forces | SOC Defenders

---

Last Updated: January 15, 2026