CERT-UA detected a new wave of attacks on defense enterprises and the Defense Forces of Ukraine - State Special Communications Service
Kyiv • UNN
CERT-UA detected phishing attacks via Signal on defense enterprises and the Defense Forces. Attackers distributed malicious archives disguised as meeting reports, using compromised accounts for trust.
The Governmental Computer Emergency Response Team of Ukraine CERT-UA has recorded new cases of targeted cyberattacks on employees of defense industry enterprises and representatives of the Defense Forces of Ukraine. This is reported by the State Special Communications Service, writes UNN.
During March 2025, attackers distributed phishing messages containing malicious archives in the Signal messenger. Hackers disguised attached files as a report on the results of the meeting. In some cases, to increase confidence in the message, it was sent on behalf of familiar contacts whose accounts had been previously hacked by attackers
It is noted that phishing archives usually contain: a lure file with the extension "pdf" and an executable file DarkTortilla – a cryptor/loader that decrypts and launches the DarkCrystal RAT (DCRAT) remote control tool.
This activity has been tracked by CERT-UA under the identifier UAC-0200 since at least the summer of 2024. Since February 2025, the content of lure messages has concerned UAVs, electronic warfare equipment and other military technologies
CERT-UA reminds that the use of popular messengers, such as Signal, WhatsApp, Telegram, Viber, both on mobile devices and computers, significantly expands the attack surface. They create uncontrolled channels for information exchange, which makes it difficult to detect threats with standard cyber protection tools.
