PLUGGYAPE
PluggyApe is a Python-based backdoor used in targeted cyber-espionage campaigns against Ukraine’s Defense Forces between October and December 2025. CERT-UA attributed the activity with medium confidence to the Russian-aligned threat actor tracked as UAC-0190, also known as Void Blizzard and Laundry Bear. Delivery relied on social engineering via Signal and WhatsApp, including charity-themed lures, fake charitable-foundation websites, direct file sharing in chat, password-protected archives, and deceptive double-extension executables such as .docx.pif and earlier .pdf.exe loaders. In multiple cases the payload was packaged with PyInstaller.
Once executed, PluggyApe installs a persistent backdoor that provides remote access to the infected Windows system. Reported capabilities include host profiling, generation of a unique victim or device identifier using hardware/system attributes hashed with SHA-256, remote command or arbitrary code execution, and data exfiltration. Persistence is established through Windows Registry Run-key modification; CERT-UA specifically reported HKCU\Software\Microsoft\Windows\CurrentVersion\Run with the value name RealtekDevice. PluggyApe communicates with command infrastructure over WebSocket and/or MQTT and exchanges data in JSON format.
The malware evolved during the campaign. Early October 2025 activity used a loader that downloaded a Python interpreter and an early PluggyApe script from Pastebin. By December 2025, an improved obfuscated variant, PLUGGYAPE.V2, was observed using MQTT, enhanced obfuscation, and anti-analysis checks including virtual-machine detection. Later variants also improved operational resilience by retrieving Base64-encoded C2 addresses from public paste services such as pastebin.com and rentry.co instead of relying only on hardcoded infrastructure.
High-confidence infrastructure and artifacts directly mentioned in the content include C2 IPs 193.23.216.39, 108.165.164.155, and 176.9.23.216; related endpoints tcp://193.23.216.39:8765, tcp://193.23.216.39:1883, tcp://108.165.164.155:1883, and tcp://176.9.23.216:1883; additional related infrastructure 144.31.25.203, 144.31.106.23, and 144.31.25.222; themed or attacker-controlled domains saint-daniel.org, saint-daniel.world, hart-hulp-ua.com, harthulp-ua.com, solidarity-help.com, and solidarity-help.org; public resources including pastebin.com raw URLs, ghostbin.axel.org, and rentry.co/MicrosoftAdvertisingEndpoint; lure filenames such as Drone positions in warehouse 1 (Suceava).pdf.exe, Warehouse positions 1 (Chisinau).pdf.exe, Warehouse positions 1 (Lodz).pdf.exe, Zverninya.docx.exe, Inventory_list.docx.pif, Inventory List.dоcх.pif, Inventory_list.docx (1).pif, blank_zvernenya.docx.pif, and Inventory_list_new.docx.pif; PluggyApe-related Python files qAKhdTLq.py, main.py, Inventory_list.docx.pif.py, xy359.py, o.d.f.a.d.g.j.k.l.f.s.f.d.d.a.py, and code.py; and host artifacts %TMP%\main.py, %TMP%\o.d.f.a.d.g.j.k.l.f.s.f.d.d.a.py, and the PDB path C:\Users\User\source\repos\MolineRebuild\x64\Release\MolineRebuild.pdb.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
код основного програмного засобу розроблено з використанням мови програмування Python та класифіковано як бекдор PLUGGYAPE. Починаючи з грудня 2025 року виявлено удосконалену (та обфусковану) версію PLUGGYAPE (PLUGGYAPE.V2), в якій застосовано протокол MQTT, а також додано низку перевірок для протидії аналізу, зокрема запуску у віртуальному середовищі.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesВодночас виконуваний файл може бути надісланий безпосередньо в месенджер і здебільшого має розширення ".docx.pif".
об'єкт кібератаки засобами месенджерів спонукають до відвідування вебсайту, що імітує вебсторінку нібито одного із благодійних фондів
Execution
2 techniquesPersistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueздійснюються під виглядом діяльності благодійних фондів... пропонується завантажити "документи" - виконувані файли
Discovery
1 techniqueНа основі базової інформації про ЕОМ (MAC-адрес, серійний номер BIOS, диску та ідентифікатор процесору)
Command and Control
4 techniquesВстановлює з'єднання з сервером управління з використанням вебсокетів і/або MQTT, дані передаються у форматі JSON.
These include the use of charity‑themed lures or the hosting of operational artifacts on public text‑sharing services.
файл з розширенням ".pdf.exe", який забезпечував запуск лоадеру, призначенням якого було завантаження Python-інтерпретатору та, з Pastebin, Python-файлу ранньої версії PLUGGYAPE
IP-адреса сервера управління могла бути вказана не безпосередньо в коді програми, а публікувалася на ресурсах на кшталт rentry.co та pastebin.com, зокрема у BASE64-кодованому вигляді
IOCs tracked for this family
55 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family previously used by Laundry Bear against Ukrainian defense forces in related Russian-aligned espionage operations.
Malware used in attacks against Ukrainian defense forces; delivered via Signal and WhatsApp per CERT-UA reporting (per excerpt headline).
Python-based backdoor delivered via social engineering (fake charity sites and password-protected archives) that profiles infected hosts, sets a unique victim ID, establishes persistence via Windows Registry modification, and enables remote command execution and data exfiltration. Uses WebSocket or MQTT for C2; later versions add stronger obfuscation/anti-analysis and dynamically fetch C2 addresses from public paste services (e.g., rentry.co, pastebin.com) encoded in Base64 to enable rapid infrastructure rotation.
Backdoor deployed via PyInstaller-built malicious PIF files delivered in password-protected archives. It profiles the host, exfiltrates data, awaits remote commands, and maintains persistence via Windows Registry modifications. C2 addresses are retrieved from external paste sites (e.g., rentry.co, pastebin.com). An updated PluggyApe version 2 adds enhanced obfuscation and anti-analysis features.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.