Sophos, a global leader in next-generation cybersecurity, has published, “Android APT Spyware, Targeting Middle East Victims, Enhances Evasiveness,” detailing new variants of Android spyware linked to C-23, an advanced persistent threat (APT) adversary that has been active in the Middle East since 2017. The new variants are enhanced for stealth and persistence.
The spyware presents itself as an update app with a generic icon and name, such as “App Updates.” Sophos researchers believe the attackers distribute the spyware app by sending a download link in the form of a text message to the target's phone. The first time a target runs the spyware app, it asks for permissions to control various aspects of the phone. The attackers use social engineering techniques to convince the target these permissions are essential for the app to function. After the target has granted the necessary rights, the spyware then disguises itself using the name and icon of a legitimate app. This makes it harder for the phone's user to find and manually remove the spyware.
The New Variants
The new variants use more, and more varied, disguises than previous versions, hiding behind popular app icons such as Chrome, Google, Google Play, YouTube, or the BOTIM voice-over-IP service. If targets click a fraudulent icon, the spyware launches the legitimate version of the app, while maintaining surveillance in the background.
Previous versions of the spyware relied on a single command-and-control domain that was hardcoded into the app and operated by the attackers. If a defender found and took down the domain, the spyware was disabled. Sophos researchers believe that the attackers have tried to address this potential point of weakness in the new variants, which can switch the command-and-control server to a different domain. This allows the spyware to continue operating even after a domain takedown.
The new variants share code with other malware samples attributed to APT C-23. Sophos researchers also found Arabic language strings in the code and observed that some of the text could be presented in either English or Arabic, depending on the language setting of a victim’s phone.
Nefarious features from previous versions of the spyware remain unchanged, such as: collecting text from SMS or other apps, contacts, call logs, images, and documents; recording ambient audio and incoming and outgoing calls, including WhatsApp calls; taking pictures and screen shots using a phone’s camera and recording videos of the screen; reading notifications from social media and messaging apps; and canceling notifications from built-in security apps, as well as from Android system apps. The spyware can also supress its own notifications.
“Spyware is a growing threat in an increasingly connected world,” said Pankaj Kohli, threat researcher at Sophos. “The Android spyware linked to APT C-23 has been around for at least four years, and attackers continue to develop it with new techniques that evade detection and removal. The attackers also use social engineering to lure victims into granting the permissions needed to see into every corner of their digital life. Fortunately, there are practical steps that people can take to protect against spyware and many of them are worth applying even if users don’t believe they’re a target for surveillance.”
Sophos recommends the following actions for anyone concerned about spyware or Potentially Unwanted Applications (PUAs):
- Users should be wary of apps asking for sensitive permissions, such as device admin or notification access, or those requiring superuser/root access. Users can view apps with device admin and notification access permissions by browsing “Settings” and searching for "device admin apps" and "notification access," respectively
- The sudden disappearance of an app icon after running it for the first time, which is often an indicator of an unwanted or malicious application
- Targets of this family of spyware can remove the apps manually by navigating to the list of installed apps, selecting “Settings->Apps” and then scrolling to find the name the app used when it was first installed (such as "App Updates," “System Apps Updates” or “Android Update Intelligence”)
- However, many other forms of mobile malware conceal themselves from the list of installed apps. To remove these, users need the help of an anti-malware application
- Sophos also advises users to install a mobile security solution, such as Intercept X for Mobile, to automatically detect spyware and malware
- To avoid falling prey to malicious apps, users should only install mobile apps from trusted sources, such as Google Play. Update Android OS and other apps via Android Settings and Google Play respectively, instead of relying on third parties
SophosLabs has published indicators of compromise on its Github page.
To learn more about the Android spyware, read the article on SophosLabs Uncut.