A new Android malware has been discovered hidden inside trojanized versions of the Alpine Quest mapping app, which is reportedly used by Russian soldiers as part of war zone operational planning.

Attackers promote the trojanized app as a free, cracked version of the premium Alpine Quest Pro, using Telegram channels and Russian app catalogs for distribution.

AlpineQuest is a legitimate GPS and topographic mapping app for Android used by adventurers, athletes, search-and-rescue teams, and military personnel, valued for its offline capabilities and precision.

The app has two versions: a free Lite version with limited features and a paid Pro version that is free of tracking libraries, analytics, and advertisements.

The spyware, which was discovered by researchers at Russian mobile antivirus company Doctor Web, hides inside a fully working Alpine Quest app, reducing suspicion and creating valuable data theft opportunities.

Once launched, it attempts to steal communication data and sensitive documents from the device, potentially revealing details about army operations. Specifically, the spyware performs the following actions:

• Sends the user’s phone number, contacts, geolocation, file info, and app version to attackers.
• Monitors location changes in real-time and sends updates to a Telegram bot.
• Downloads additional modules to steal confidential files, especially those sent via Telegram and WhatsApp.
• Seeks the ‘locLog’ file from Alpine Quest, which contains location history logs.

Doctor Web tracks the previously undocumented spyware as ‘Android.Spy. 1292.origin’ but did not make any attributions about its origin in its report. Indicators of compromise are available here.

Turning the tables

The tactic of targeting soldiers was previously associated with Russian hacking operations, often linked to state-sponsored threat groups collecting intelligence for the Russian army.

In December 2022, hackers using a compromised Ukrainian Ministry of Defense email account attempted subsequent infections by using DELTA, a Ukrainian intelligence collection and management system as bait.

In October 2024, the Russian threat group ‘UNC5812’ targeted Ukrainian conscripts with Windows and Android malware via a fake agency named ‘Civil Defense.’

More recently, in February 2025, Google researchers revealed that Russian threat actors of the APT44 group used malicious QR codes to trick targets into syncing their Signal accounts with unauthorized devices.

The discovery of the trojanized AlpineQuest app shows that these sneaky attacks are orchestrated from both ends of the conflict, as intelligence collection remains crucial in gaining battlefield advantage.

Per a report from the state-run news agency TASS, the man is a resident of the Oryol Oblast, some 370km to the south of Moscow.

The court heard that the man used crypto to “transfer money” to the Armed Forces of Ukraine on “multiple occasions.”

Another Russian Convicted for Sending Crypto to Ukrainian Army

The unnamed man was charged with treason-related offenses by the Federal Security Service (FSB).

The agency has seemingly intensified its crackdown on Russian supporters of Ukraine’s military forces in recent months.

The FSB likely has access to a range of blockchain analytics tools that let law enforcers monitor individual crypto users.

These tools were first put into operation by the Russian anti-AML body Federal Financial Monitoring Service (Rosfinmonitoring) in early 2023.

Last year, Russian scientists also said they had developed a solution that helps law enforcers fight against “criminals” who make use of Bitcoin (BTC) and Ethereum (ETH).

The court also ordered the man to pay a 500,000 ruble (around $6,000) fine.

TASS reported that a branch of the Western District Military Court heard that the man made “multiple transfers of funds” to “armed formations” in based Ukraine.

The FSB’s press service claimed the man was a member of Telegram channels run by “Ukrainian terrorist organizations.”

Man ‘Made Multiple Crypto Transfers’

The agency said the man “repeatedly transferred funds” in “support” of the groups in 2023 and 2024.” The FSB said:

“The [crypto] was used to buy drones, weapons, ammunition, and tactical equipment for the Ukrainian army. These were all intended to help conduct military operations against soldiers of the Russian Armed Forces.”

The court convicted the man of “high treason” and “assisting a terrorist activity,” both “violations of the Criminal Code of the Russian Federation.”

The FSB released scant details about the man, noting only that he was a resident of Oryol, and that he was born in 1976.

However, the FSB released a video “confession” from the man, where he addressed the camera and said:

“I sent […] cryptoassets. […] I knew that I was sending it to [groups] that were fighting on Ukraine’s side.”

FSB’s Crypto Crackdown

The FSB has made scores of similar arrests in recent months. Most recently, it arrested a man in the city of Nizhny Novgorod, accusing him of sending crypto to Ukraine-based militants. The agency said that the militants used the funds to buy drones.

The agency’s arrest report also featured a similar video confession, with the suspect’s face blurred and very little information provided about his identity.

The FSB made another arrest on March 19, swooping on an address in Krasnodar Krai to arrest a man who it says “gave the Ukrainian special services information about a Russian military facility.”

Per a separate TASS report, the man, the agency said, “proactively contacted representatives” of the Ukrainian army.

He then reportedly let them know about the facility, which is located near his home.

The FSB says Ukraine’s military uses Russian crypto donations to buy items including “unmanned thermal imaging sights, aircraft, ammunition, and uniforms.”

Other arrestees, also charged with sending crypto to Ukrainian Armed Forces units and Russian paramilitaries based in Ukraine, include a Moscow-based scientist and a resident of the Russian Far Eastern region of Khabarovsk Krai.

The post Russia Jails Citizen for 15 Years for ‘Sending Crypto to Ukrainian Army’ appeared first on Cryptonews.