SBU exposes russian intelligence attempts to penetrate Armed Forces' planning operations system.pdf

SBU technical report attributes a prolonged cyber operation to Russian military intelligence (Sandworm) that sought to compromise Android devices used by Ukrainian military via exposed ADB (port 5555). Multiple custom malware families were documented—providing persistence (netd replacement), remote access (Tor hidden services, Dropbear/SSH), data collection (including Starlink telemetry), and Mirai-type downloaders—along with network scan examples, C2 IPs and numerous file hashes; the operation was detected and neutralized.