Connect with us

Hi, what are you looking for?

HEADLINES

New variants of Android spyware linked to APT C-23 enhanced for stealth and persistence – Sophos

The spyware presents itself as an update app with a generic icon and name, such as “App Updates.” Sophos researchers believe the attackers distribute the spyware app by sending a download link in the form of a text message to the target’s phone.

Sophos, a global leader in next-generation cybersecurity, recently published “Android APT Spyware, Targeting Middle East Victims, Enhances Evasiveness,” detailing new variants of Android spyware linked to C-23, an advanced persistent threat (APT) adversary that has been active in the Middle East since 2017. The new variants are enhanced for stealth and persistence.

The spyware presents itself as an update app with a generic icon and name, such as “App Updates.” Sophos researchers believe the attackers distribute the spyware app by sending a download link in the form of a text message to the target’s phone. The first time a target runs the spyware app, it asks for permissions to control various aspects of the phone. The attackers use social engineering techniques to convince the target these permissions are essential for the app to function. After the target has granted the necessary rights, the spyware then disguises itself using the name and icon of a legitimate app. This makes it harder for the phone’s user to find and manually remove the spyware. 

The New Variants

The new variants use more, and more varied, disguises than previous versions, hiding behind popular app icons such as Chrome, Google, Google Play, YouTube, or the BOTIM voice-over-IP service. If targets click a fraudulent icon, the spyware launches the legitimate version of the app, while maintaining surveillance in the background.  

Previous versions of the spyware relied on a single command-and-control domain that was hardcoded into the app and operated by the attackers. If a defender found and took down the domain, the spyware was disabled. Sophos researchers believe that the attackers have tried to address this potential point of weakness in the new variants, which can switch the command-and-control server to a different domain. This allows the spyware to continue operating even after a domain takedown. 

The new variants share code with other malware samples attributed to APT C-23. Sophos researchers also found Arabic language strings in the code and observed that some of the text could be presented in either English or Arabic, depending on the language setting of a victim’s phone.

Advertisement. Scroll to continue reading.

Nefarious features from previous versions of the spyware remain unchanged, such as: collecting text from SMS or other apps, contacts, call logs, images, and documents; recording ambient audio and incoming and outgoing calls, including WhatsApp calls; taking pictures and screen shots using a phone’s camera and recording videos of the screen; reading notifications from social media and messaging apps; and canceling notifications from built-in security apps, as well as from Android system apps. The spyware can also supress its own notifications.

“Spyware is a growing threat in an increasingly connected world,” said Pankaj Kohli, threat researcher at Sophos. “The Android spyware linked to APT C-23 has been around for at least four years, and attackers continue to develop it with new techniques that evade detection and removal. The attackers also use social engineering to lure victims into granting the permissions needed to see into every corner of their digital life. Fortunately, there are practical steps that people can take to protect against spyware and many of them are worth applying even if users don’t believe they’re a target for surveillance.”

Sophos recommends the following actions for anyone concerned about spyware or Potentially Unwanted Applications (PUAs):

  • Users should be wary of apps asking for sensitive permissions, such as device admin or notification access, or those requiring superuser/root access. Users can view apps with device admin and notification access permissions by browsing “Settings” and searching for “device admin apps” and “notification access,” respectively
  • The sudden disappearance of an app icon after running it for the first time, which is often an indicator of an unwanted or malicious application
  • Targets of this family of spyware can remove the apps manually by navigating to the list of installed apps, selecting “Settings->Apps”and then scrolling to find the name the app used when it was first installed (such as “App Updates,” “System Apps Updates” or “Android Update Intelligence”) 
  • However, many other forms of mobile malware conceal themselves from the list of installed apps. To remove these, users need the help of an anti-malware application
  • Sophos also advises users to install a mobile security solution, such as Intercept X for Mobile, to automatically detect spyware and malware
  • To avoid falling prey to malicious apps, users should only install mobile apps from trusted sources, such as Google Play. Update Android OS and other apps via Android Settings and Google Play respectively, instead of relying on third parties

SophosLabs has published indicators of compromise on its Github page. 

To learn more about the Android spyware, read the article on SophosLabs Uncut.

Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

Head on over to The Lenovo Experience store and check out your favorite devices in person at Cyberzone, SM Megamall B. 

HEADLINES

DCME President Eric Alberto points to a  Moody’s report that gave a stable outlook to Asia Pacific’s telecommunications sector over the next 12-18 months,...

HEADLINES

The world has seen some high-profile incidents where cybercriminals took advantage of the weaknesses of ICT vendors, and used them as attack launch pads...

HEADLINES

The partnership gives malls and large retail chains in the Philippines the ability to provide a better user experience for consumer campaigns, streamline their...

HEADLINES

The Pacific Telecommunications Council (PTC) which groups ICT companies from over 45 countries in the Pacific Rim is the foremost global non-profit organization promoting...

HEADLINES

beep card operator AF Payments Inc. is harnessing near-field communication (NFC) technology present in mobile phones to enable users to conveniently top up their card...

HEADLINES

The X-Hub combines the flagship physical store in Malaysia with an integrated O2O platform to create a hyper-personal and seamless omnichannel commerce journey across...

HEADLINES

In 2022 and beyond, instead of a focus on keyboards and touchpads, expect to see more flexible display options, ergonomic mice, haptic feedback, voice-to-text...

Advertisement