Ukraine Cautions Espionage Targeting Its Military Technology

Ukraine has cautioned heightened cyberattacks directly toward its military institutions, particularly the branches that work with developing new technology for the military.

The attacks were often carried out via infected Excel attachments disguised as official documents, according to a Monday Facebook update by the State Service for Special Communications and Information Protection of Ukraine.

The institution, citing findings by the Computer Emergency Response Team of Ukraine (CERT-UA), said it has recorded increasing attempts “against Ukrainian institutions involved in the development of innovations in the military sector since the beginning of February 2025.”

“The attacks are carried out by distributing emails with Excel documents. The file names and email subjects mention topical and sensitive issues – demining, administrative fines, [unmanned aerial vehicle] UAV production, compensation for destroyed property, etc,” the update says.

CERT-UA detailed the form of attack in its Sunday press release, where it said the malicious code  aimed to “[provide] access to databases of Internet browsers” are embedded inside the cells, where they are then extracted to malignant parties via Telegram.

“As of April 2025, two types of software tools for implementing the cyber threat are known. The first is a .NET program, the resources of which contain a PowerShell script, which is functionally a reverse-shell borrowed from the public GitHub repository PSSW100AVB,” the press release states.

Other Topics of Interest

President of Georgia on Protests, Security in the Black Sea Region, and the Country’s Prospects

In an interview with Kyiv Post, Salome Zourabichvili – still recognized as president of Georgia by the EU and Ukraine, notwithstanding claims that she lost the fraudulent 2024 elections – discusses the importance of Georgia for security in the Black Sea region and the significance of the protests in Tbilisi against the pro-Russian government. She also addresses the plight of imprisoned former Georgian President Mikheil Saakashvili.

“The second, classified as GIFTEDCROOK, is a C/C++ stealer program that, among other things, provides access to databases of Internet browsers Chrome, Edge, Firefox (Cookies, history, saved authentication data), their archiving using the PowerShell cmdlet Compress-Archive, and subsequent exfiltration to Telegram,” it adds.

While the State Service for Special Communications and Information Protection of Ukraine said the cyberattacks targeted various military and law enforcement bodies – especially those on the east close to the front line – it did not name Russia as the culprit.

“Cybercriminals are also targeting military formations, law enforcement agencies, and local governments, particularly those located near Ukraine’s eastern border,” the update adds.

Russia’s invasion of Ukraine has seen widespread cyberattacks by both sides, sometimes with real-world consequences when infrastructure is targeted and rendered inoperational.