Targeted cyberattacks on the defense sector recorded in Ukraine via a popular messenger.
19.03.2025
2635

Journalist
Shostal Oleksandr
19.03.2025
2635

The CERT-UA team has detected cyberattacks on employees of the defense industry and the Armed Forces of Ukraine.
In March 2025, messages containing reports were found in the Signal messenger. Some messages were sent from individuals with compromised accounts to increase trust.
Typically, these archives contain a .pdf file and an executable file named DarkTortilla. DarkTortilla is a crypter/loader used to launch the remote control program Dark Crystal RAT (DCRAT).
'It should be noted that this activity has been tracked under the identifier UAC-0200 since at least the summer of 2024. Meanwhile, starting in February 2025, the content of the bait messages relates to UAVs, electronic warfare means, etc. The use of popular messengers, both on mobile devices and computers, significantly expands the attack surface, including by creating uncontrolled (in terms of protection means) channels for information exchange,' - CERT-UA reported.
Read also
- Man avoided mobilization due to a mistake of the TCC — details
- The USA has voted to extend military aid to Ukraine
- Zelensky commented on the night attack of the Russian Federation on Ukraine - video
- Umerov talked about key tasks as head of the National Security and Defense Council
- Hetmantsev explained the situation with the minimum subsistence level in Ukraine
- Ukrzaliznytsia comments on the latest Russian attacks on trains