Russian-linked cyber espionage group UNC5812 has been targeting Ukrainian military conscripts with Windows and Android malware in a sophisticated campaign. Disguised as recruitment avoidance tools, the malware has been distributed via a Telegram channel named “Civil Defense” and a website registered earlier this year. The campaign was uncovered by Google’s Threat Analysis Group (TAG) and Mandiant in late 2024. The primary target of this cyber campaign is Ukrainian men of draft age. UNC5812 promotes what it claims is “free software” to help users track and avoid military recruiters. The apps, branded as “Sunspinner,” are designed to appear as crowd-sourced tools but instead deliver potent malware to compromise victims' devices. According to Google’s report , the Android version installs CraxsRAT, a notorious remote access trojan (RAT) with capabilities such as real-time location tracking, keystroke logging, and camera control. On Windows devices, a malicious ZIP file drops Pronsi...