APT28__2016__Crowdstrike_FancyBearTracksUkrainianArtillery_12-22-2016.pdf

CrowdStrike describes discovery of a FANCY BEAR X-Agent Android variant embedded in a legitimate Ukrainian D-30 howitzer targeting app (Попр-Д30.apk); the malware exfiltrated contacts, SMS, call logs, internet data and coarse location to support reconnaissance of artillery units, and CrowdStrike assesses it as a GRU-linked, targeted nation-state campaign that expanded Russian mobile malware capabilities on the battlefield.