Signal messages for AFU and IDF recruiting contained malware

Ukrainian officers received malware through messages on Signal, falsely claiming to be related to recruitment for the 3rd Separate Assault Brigade (AFU) and the Israel Defense Forces (IDF).

The Computer Emergency Response Team of Ukraine (CERT-UA) has taken action against a series of cyberattacks originating from malicious Signal messages.

The malicious messages contained archived files with military-themed titles such as "survey of the prisoner," "geolocations," "coding commands," and "callsigns." The intention was to deceive military officers into opening and executing these files.

The archived files were infected with REMCOSRAT and REVERSESSH malware, which gives remote access to computers for threat actors.

Specialists from Trendmicro, an American-Japanese company, uncovered and reported the cyberattack to CERT-UA in late December 2023.

Since the outbreak of war in Ukraine, cyber warfare on both sides has intensified, targeting strategic infrastructure to get an edge in conventional warfare.