UNC5812 under the guise of “Civil Defense” on Telegram distributed free Ukrainian military recruiter locator software, which when downloaded on Android devices triggered the deployment of the CraxsRat backdoor, which has keystroke tracking, contact and credential exfiltration, and file and SMS management capabilities, as well as the decoy mapping app Sunspinner, according to a report from the Google Threat Intelligence Group.

Source: SC Magazine