Article Details
Scrape Timestamp (UTC): 2025-04-23 18:35:55.488
Original Article Text
Click to Toggle View
Russian army targeted by new Android malware hidden in mapping app. A new Android malware has been discovered hidden inside trojanized versions of the Alpine Quest mapping app, which is reportedly used by Russian soldiers as part of war zone operational planning. Attackers promote the trojanized app as a free, cracked version of the premium Alpine Quest Pro, using Telegram channels and Russian app catalogs for distribution. AlpineQuest is a legitimate GPS and topographic mapping app for Android used by adventurers, athletes, search-and-rescue teams, and military personnel, valued for its offline capabilities and precision. The app has two versions: a free Lite version with limited features and a paid Pro version that is free of tracking libraries, analytics, and advertisements. The spyware, which was discovered by researchers at Russian mobile antivirus company Doctor Web, hides inside a fully working Alpine Quest app, reducing suspicion and creating valuable data theft opportunities. Once launched, it attempts to steal communication data and sensitive documents from the device, potentially revealing details about army operations. Specifically, the spyware performs the following actions: Doctor Web tracks the previously undocumented spyware as 'Android.Spy. 1292.origin' but did not make any attributions about its origin in its report. Indicators of compromise are available here. Turning the tables The tactic of targeting soldiers was previously associated with Russian hacking operations, often linked to state-sponsored threat groups collecting intelligence for the Russian army. In December 2022, hackers using a compromised Ukrainian Ministry of Defense email account attempted subsequent infections by using DELTA, a Ukrainian intelligence collection and management system as bait. In October 2024, the Russian threat group 'UNC5812' targeted Ukrainian conscripts with Windows and Android malware via a fake agency named 'Civil Defense.' More recently, in February 2025, Google researchers revealed that Russian threat actors of the APT44 group used malicious QR codes to trick targets into syncing their Signal accounts with unauthorized devices. The discovery of the trojanized AlpineQuest app shows that these sneaky attacks are orchestrated from both ends of the conflict, as intelligence collection remains crucial in gaining battlefield advantage.
Daily Brief Summary
Security researchers have uncovered a new Android malware embedded within fake versions of the Alpine Quest mapping app.
The compromised versions, which mirror the Alpine Quest Pro app, are distributed via Telegram channels and Russian mobile app repositories.
Attackers use the promise of a free, premium app to lure Russian military personnel, exploiting the app's popularity in military and outdoor activities.
The malicious software aims to steal documents and communication data from infected devices, potentially exposing sensitive military operational details.
The malware functions by masquerading as a legitimate application, increasing the likelihood of download and use by unsuspecting users.
The trojanized app was discovered by the Russian antivirus firm Doctor Web, who named the threat 'Android.Spy. 1292.origin' without attributing it to any specific origin.
This event highlights a shift where Russian soldiers, traditionally seen as perpetrators of similar tactics, are now also victims in cyber-espionage campaigns.