Russian espionage mission to subvert Ukrainian conscription uncovered by Google TAG
Anti-conscription messaging lures potential recruits to download malware disguised as a crowd-sourced mapping application
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Google’s Threat Analysis Group (TAG), alongside Mandiant, has released findings on what it suspects is a Russian espionage and influence campaign designed to demotivate Ukrainian soldiers and infect devices withmalware.
The group has been labeled UNC5812, and established themselves as an anti-conscription group called ‘Civil Defense’ that offered apps and software to allow would-be conscripts to view real-time locations of Ukrainian military recruiters.
However, the applications would instead deliver malware alongside a decoy mapping application tracked by Google TAG and Mandiant as SUNSPINNER.
Civil Defense influence campaign
“The ultimate aim of the campaign is to have victims navigate to the UNC5812-controlled “Civil Defense” website, which advertises several different software programs for differentoperating systems. When installed, these programs result in the download of various commodity malware families,” theGoogle Threat Intelligence blogstated.
The Civil Defense website was established as early as April 2024, however the Telegram account which granted a high through-put of users to the website was only set up in September 2024.
It is understood the group paid for sponsored posts in popular Telegram groups, one of which was used to deliver missile alerts to its 80,000 subscribers.
When users were directed to the website, they were faced with a choice of files aimed at different operating systems that the victims expected to be some form of mapping software for real time updates on the location of Ukrainian military recruiters. Users would instead find their device infected with SUNSPINNER malware and infostealers.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The website also offered justification for the applications not being available through the App Store, stating that by downloading the application through the website, Civil Defense would “protect the anonymity and security” of its users from the App Store. The website also contained video instructions on how to install the applications, and how to disableGoogle PlayProtect.
The Civil Defense telegram page also requested user video submissions of “unfair actions from territorial recruitment centers,” which Civil Defense would post to enhance its anti-conscription messaging and potentially drive more people to download the military recruitment monitoring app.
The SUNSPINNER app consists of a decoy GUI that shows a mapping tool with crowdsourced marker locations for Ukrainian recruiters. While the marker locations look to be legitimate, Google TAG and Mandiant found that the markers were all added by a single person on the same day.
The malware and influence campaign is said to still be underway, with a sponsored post for the group appearing in a Ukrainian news channel as recently as October 8.
More from TechRadar Pro
Benedict has been writing about security issues for over 7 years, first focusing on geopolitics and international relations while at the University of Buckingham. During this time he studied BA Politics with Journalism, for which he received a second-class honours (upper division), then continuing his studies at a postgraduate level, achieving a distinction in MA Security, Intelligence and Diplomacy. Upon joining TechRadar Pro as a Staff Writer, Benedict transitioned his focus towards cybersecurity, exploring state-sponsored threat actors, malware, social engineering, and national security. Benedict is also an expert on B2B security products, including firewalls, antivirus, endpoint security, and password management.
Cybersecurity is business survival and CISOs need to act now
The real battle for generative AI in software
HPE reveals critical security bug affecting networking access points
