Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units

CrowdStrike details how FANCY BEAR (likely GRU) distributed an Android variant of its X-Agent remote access toolkit inside a trojanized D-30 artillery targeting app ('Понп-Д30.apk') used by Ukrainian forces; reverse engineering linked the APK to Windows X-Agent via protocol and cryptography, provided an MD5 indicator and a Snort rule for detection, and argued that the malware's collection of communications and location data likely enabled Russian forces to identify and target Ukrainian artillery units, contributing to significant equipment losses.