Google’s Threat Analysis Group (TAG), alongside Mandiant, has released findings on what it suspects is a Russian espionage and influence campaign designed to demotivate Ukrainian soldiers and infect devices with malware.
The group has been labeled UNC5812, and established themselves as an anti-conscription group called ‘Civil Defense’ that offered apps and software to allow would-be conscripts to view real-time locations of Ukrainian military recruiters.
However, the applications would instead deliver malware alongside a decoy mapping application tracked by Google TAG and Mandiant as SUNSPINNER.
Civil Defense influence campaign
“The ultimate aim of the campaign is to have victims navigate to the UNC5812-controlled “Civil Defense” website, which advertises several different software programs for different operating systems. When installed, these programs result in the download of various commodity malware families,” the Google Threat Intelligence blog stated.
The Civil Defense website was established as early as April 2024, however the Telegram account which granted a high through-put of users to the website was only set up in September 2024.
It is understood the group paid for sponsored posts in popular Telegram groups, one of which was used to deliver missile alerts to its 80,000 subscribers.
When users were directed to the website, they were faced with a choice of files aimed at different operating systems that the victims expected to be some form of mapping software for real time updates on the location of Ukrainian military recruiters. Users would instead find their device infected with SUNSPINNER malware and infostealers.
The website also offered justification for the applications not being available through the App Store, stating that by downloading the application through the website, Civil Defense would “protect the anonymity and security” of its users from the App Store. The website also contained video instructions on how to install the applications, and how to disable Google Play Protect.
The Civil Defense telegram page also requested user video submissions of “unfair actions from territorial recruitment centers,” which Civil Defense would post to enhance its anti-conscription messaging and potentially drive more people to download the military recruitment monitoring app.
The SUNSPINNER app consists of a decoy GUI that shows a mapping tool with crowdsourced marker locations for Ukrainian recruiters. While the marker locations look to be legitimate, Google TAG and Mandiant found that the markers were all added by a single person on the same day.
The malware and influence campaign is said to still be underway, with a sponsored post for the group appearing in a Ukrainian news channel as recently as October 8.
More from TechRadar Pro
- Take a look at the best Android antivirus
- Amazon seizes domains used by Russian hackers to target Windows systems
- These are the best password managers