On 31 August 2023, the National Cyber Security Centre (NCSC), alongside international partners, published a report on a malware campaign targeting Android mobile devices used by the Ukrainian military.
The malware, referred to as ‘Infamous Chisel’, has been used by the Russian cyber threat group known as Sandworm. NCSC has previously attributed Sandworm to the Russian General Staff Main Intelligence Directorate’s (GRU) Main Centre for Special Technologies (GTsST).
Infamous Chisel enables persistent access to, and the collation and exfiltration of data from, compromised Android devices. This includes targeting applications used by the Ukrainian military.
Infamous Chisel has highly likely been used with the aim of stealing sensitive military information. This activity demonstrates Russia’s continued use of cyber capabilities to support the invasion of Ukraine.
They should examine if GrapheneOS would work for their needs. A lot less attack surface as far as Android phones go.
Edit: Probably a good idea to avoid Telegram as well in favor of better platforms and apps like Signal, Matrix, etc. Not sure where Telegram is run from but I don't trust them