New Variants of Android Spyware Linked to APT C-23 Enhanced for Stealth and Persistence, Sophos Research Reveals
OXFORD, United Kingdom, Nov. 23, 2021 (GLOBE NEWSWIRE) -- Sophos, a global leader in next-generation cybersecurity, has published, “Android APT Spyware, Targeting Middle East Victims, Enhances Evasiveness,” detailing new variants of Android spyware linked to C-23, an advanced persistent threat (APT) adversary that has been active in the Middle East since 2017. The new variants are enhanced for stealth and persistence.
The spyware presents itself as an update app with a generic icon and name, such as “App Updates.” Sophos researchers believe the attackers distribute the spyware app by sending a download link in the form of a text message to the target's phone. The first time a target runs the spyware app, it asks for permissions to control various aspects of the phone. The attackers use social engineering techniques to convince the target these permissions are essential for the app to function. After the target has granted the necessary rights, the spyware then disguises itself using the name and icon of a legitimate app. This makes it harder for the phone's user to find and manually remove the spyware.
The New Variants
The new variants use more, and more varied, disguises than previous versions, hiding behind popular app icons such as Chrome, Google, Google Play, YouTube, or the BOTIM voice-over-IP service. If targets click a fraudulent icon, the spyware launches the legitimate version of the app, while maintaining surveillance in the background.
Previous versions of the spyware relied on a single command-and-control domain that was hardcoded into the app and operated by the attackers. If a defender found and took down the domain, the spyware was disabled. Sophos researchers believe that the attackers have tried to address this potential point of weakness in the new variants, which can switch the command-and-control server to a different domain. This allows the spyware to continue operating even after a domain takedown.
The new variants share code with other malware samples attributed to APT C-23. Sophos researchers also found Arabic language strings in the code and observed that some of the text could be presented in either English or Arabic, depending on the language setting of a victim’s phone.
Nefarious features from previous versions of the spyware remain unchanged, such as: collecting text from SMS or other apps, contacts, call logs, images, and documents; recording ambient audio and incoming and outgoing calls, including WhatsApp calls; taking pictures and screen shots using a phone’s camera and recording videos of the screen; reading notifications from social media and messaging apps; and canceling notifications from built-in security apps, s well as from Android system apps. The spyware can also supress its own notifications.
“Spyware is a growing threat in an increasingly connected world,” said Pankaj Kohli, threat researcher at Sophos. “The Android spyware linked to APT C-23 has been around for at least four years, and attackers continue to develop it with new techniques that evade detection and removal. The attackers also use social engineering to lure victims into granting the permissions needed to see into every corner of their digital life. Fortunately, there are practical steps that people can take to protect against spyware and many of them are worth applying even if users don’t believe they’re a target for surveillance.”
Sophos recommends the following actions for anyone concerned about spyware or Potentially Unwanted Applications (PUAs):
SophosLabs has published indicators of compromise on its Github page.
Contact Info: Samantha Powers [email protected]