On November 4, 2026, The Hacker News reported Russia-linked, APT29, Android. The framing is mine. Their sentences stay on their page.

The names I am willing to repeat are Russia-linked, APT29, Android, Ukrainian.

I follow the money path. The nickname of the crew is the least useful line.

Source I used: The Hacker News. The link is under this column.