On 31 August 2023, the National Cyber Security Centre (NCSC), alongside international partners, published a report on a malware campaign targeting Android mobile devices used by the Ukrainian military.
The malware, referred to as ‘Infamous Chisel’, has been used by the Russian cyber threat group known as Sandworm. NCSC has previously attributed Sandworm to the Russian General Staff Main Intelligence Directorate’s (GRU) Main Centre for Special Technologies (GTsST).
Infamous Chisel enables persistent access to, and the collation and exfiltration of data from, compromised Android devices. This includes targeting applications used by the Ukrainian military.
Infamous Chisel has highly likely been used with the aim of stealing sensitive military information. This activity demonstrates Russia’s continued use of cyber capabilities to support the invasion of Ukraine.
The defense is to keep your device locked down and don’t click on sketchy shit. There’s not much point in trying to publish an exhaustive list of known bad links & email attachments, as that list would be obsolete within moments of its release.