A new and alarming threat has emerged in the conflict between Russia and Ukraine: Russian hackers are launching relentless attacks against Ukrainian troops. These cyber assailants are employing a sophisticated and newly identified malware known as “Infamous Chisel” against the Ukrainian army’s Android mobile devices in an attempt to pilfer information crucial to the ongoing counteroffensive.
In collaboration with its allied counterparts from Australia, Britain, Canada, and New Zealand, the U.S. Cybersecurity and Infrastructure Security Agency (C.I.S.A.) has issued a dire warning regarding Infamous Chisel. The Agency described the malware as a collection of components that grant persistent access to infected Android devices, allowing the unauthorized collection and transmission of victims’ information. A joint report from the intelligence alliance dissecting and analyzing the malware says that it has primarily been distributed through infected tablets captured on the battlefield and is aimed at obtaining critical military information. In particular, Infamous Chisel is designed to scan files, eavesdrop on communications, and periodically steal sensitive data from compromised Android devices.
The malware’s persistence, coupled with its periodic data exfiltration, exposes vulnerabilities in Ukrainian military networks. By replacing legitimate coding within the Android system with external code that is not directly linked to the malware itself, Infamous Chisel targets data associated with military applications, device details, and commercial apps used by the Ukrainian military.
Despite its malicious intent, however, the Infamous Chisel malware is not particularly stealthy. Its components are only of low to medium sophistication and lack basic obfuscation techniques, exhibiting little concern for evading discovery or concealing malicious activity. This may be due to the absence of host-based detection systems on many Android devices. This oversight has given security experts a crucial insight into its capabilities and vulnerabilities.
Ukraine’s S.B.U. security agency first uncovered Infamous Chisel’s presence in Ukrainian systems in August. The malware was discovered in use, attempting to infiltrate the Ukrainian Armed Forces’ combat data exchange system, and officials swiftly responded with defensive cyber operations aimed at thwarting the hack. Investigations later revealed that Russia had initiated the malware attack after gaining access to Ukrainian computer tablets on the battlefield.
In particular, Ukraine has attributed the Infamous Chisel attack to a cyber threat actor known as Sandworm, a group previously linked to Russia’s G.R.U. military intelligence service. Sandworm has a history of cyberattacks, having previously targeted Ukraine’s power grid during Russia’s invasion, amongst other high-profile attacks.
Alarmed by the emergence of Infamous Chisel and the significant cyber threat it poses to Ukraine’s military operations, the international community is calling for heightened vigilance. As the conflict in the region continues, it is essential for Ukrainian forces and their allies to strengthen their cybersecurity measures to protect sensitive data and maintain operational resilience.
The emergence of such advanced malware underscores cyber warfare’s evolving role in modern conflicts, where digital assaults can be as devastating as physical ones. The joint report issued by the Five Eyes intelligence alliance underscores our need to remain vigilant and pro-active in detecting and mitigating Russian cyber activities.
