New Android spyware variants in connection with APT C-23 Enhanced

New Android spyware variants in connection with APT C-23 Enhanced

Tech Highlights:

  • The new variants use more, and more varied, disguises than previous versions, hiding behind popular app icons such as Chrome, Google, Google Play, YouTube, or the BOTIM voice-over-IP service. If targets click a fraudulent icon, the spyware launches the legitimate version of the app, while maintaining surveillance in the background. Previous versions of the spyware relied on a single command-and-control domain that was hardcoded into the app and operated by the attackers. If a defender found and took down the domain, the spyware was disabled. Sophos researchers believe that the attackers have tried to address this potential point of weakness in the new variants, which can switch the command-and-control server to a different domain. This allows the spyware to continue operating even after a domain takedown.

  • OXFORD, United Kingdom (GLOBE NEWSWIRE) — November 23, 2021 (GLOBE NEWSWIRE) — “Android APT Spyware, Targeting Middle East Victims, Enhances Evasiveness,” released by Sophos, a global leader in next-generation cybersecurity, details new varieties of Android spyware related to C-23, an advanced persistent threat (APT) adversary active in the Middle East since 2017. The stealth and persistence of the new variations have been improved. The spyware appears as an update software with a generic symbol and name like “App Updates.” According to Sophos experts, the spyware app is distributed by providing a download link to the target’s phone via text message. When a victim runs the spyware programme for the first time, it requests permission to manipulate several parts of the phone. The attackers utilise social engineering to persuade the target that these permissions are required for the programme to work. After the target has acquired the appropriate permissions, the malware impersonates a real programme by using its name and icon. This makes it more difficult for the phone’s owner to locate and remove the malware manually.

The new variants share code with other malware samples attributed to APT C-23. Sophos researchers also found Arabic language strings in the code and observed that some of the text could be presented in either English or Arabic, depending on the language setting of a victim’s phone. Nefarious features from previous versions of the spyware remain unchanged, such as: collecting text from SMS or other apps, contacts, call logs, images, and documents; recording ambient audio and incoming and outgoing calls, including WhatsApp calls; taking pictures and screen shots using a phone’s camera and recording videos of the screen; reading notifications from social media and messaging apps; and canceling notifications from built-in security apps, as well as from Android system apps. The spyware can also supress its own notifications.

The sudden disappearance of an app icon after running it for the first time, which is often an indicator of an unwanted or malicious application. Targets of this family of spyware can remove the apps manually by navigating to the list of installed apps, selecting “Settings->Apps”and then scrolling to find the name the app used when it was first installed (such as “App Updates,” “System Apps Updates” or “Android Update Intelligence”). However, many other forms of mobile malware conceal themselves from the list of installed apps. To remove these, users need the help of an anti-malware application
Sophos also advises users to install a mobile security solution, such as Intercept X for Mobile, to automatically detect spyware and malware.

“Spyware is a growing threat in an increasingly connected world,” said Pankaj Kohli, threat researcher at Sophos. “The Android spyware linked to APT C-23 has been around for at least four years, and attackers continue to develop it with new techniques that evade detection and removal. The attackers also use social engineering to lure victims into granting the permissions needed to see into every corner of their digital life. Fortunately, there are practical steps that people can take to protect against spyware and many of them are worth applying even if users don’t believe they’re a target for surveillance.”

To avoid falling prey to malicious apps, users should only install mobile apps from trusted sources, such as Google Play. Update Android OS and other apps via Android Settings and Google Play respectively, instead of relying on third parties. SophosLabs has published indicators of compromise on its Github page. To learn more about the Android spyware, read the article on SophosLabs Uncut. Further details on cyberthreats targeting mobile devices can be found in the mobile malware section in the Sophos 2022 Threat Report
Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLab Uncut, which provides Sophos’ latest threat intelligence.

Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps
Learn more about Sophos’ Rapid Response service that contains, neutralizes and investigates attacks 24/7. The four top tips for responding to a security incident from Sophos Rapid Response and the Managed Threat Response Team. Read the latest security news and views on Sophos’ award-winning news website Naked Security and on Sophos News.

Sophos is a worldwide leader in next-generation cybersecurity, protecting more than 500,000 organizations and millions of consumers in more than 150 countries from today’s most advanced cyberthreats. Powered by threat intelligence, AI and machine learning from SophosLabs and SophosAI, Sophos delivers a broad portfolio of advanced products and services to secure users, networks and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. Sophos provides a single integrated cloud-based management console, Sophos Central – the centerpiece of an adaptive cybersecurity ecosystem that features a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity vendors. Sophos sells its products and services through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.

 

We will be happy to hear your thoughts

Leave a reply

Tech Reviews, News and Guides
Logo