A new strain of Android malware, identified as 'Android.Spy.1292.origin' by Doctor Web, has been found in compromised versions of the Alpine Quest mapping application, which is popular among Russian soldiers for operational planning. Cyber attackers are distributing these trojanized versions as free alternatives to the premium app via Telegram channels and Russian app catalogs. The malware collects sensitive data, including the user's phone number, contacts, geolocation, and files, and can monitor real-time location changes. It also downloads additional modules to extract confidential files, particularly from Telegram and WhatsApp, and searches for location history logs within the app. This tactic is part of a broader trend of targeting military personnel for intelligence gathering, historically linked to Russian state-sponsored hacking operations.