The Carrier
- Lookout has identified 71 malware spreading Android apps, connected to the same command-and-control (C2) server.
- The long-running surveillance campaign, which appears to have been active since January 2018, has recently started using COVID-19 lures to take advantage of the panic caused by the pandemic.
The Malware
- 64 apps carry SpyNote, a family of commercial surveillanceware.
- The other apps carry SandroRat, AndoServer, and SLRat.
- The downloaded app serves as a distraction, while the malware runs in the background.
- While some AndoServer samples are only surveillanceware, others contain legitimate apps inside the malware, with benign APK hidden in the res/raw folder.
The Risk
- Once the malware is installed, hackers can:
- Take screenshots
- Record location (latitude and longitude)
- Choose and access the device camera
- Launch other malicious apps
- Exfiltrate contacts, SMS, and call logs
- Make calls and send SMS
The Threat Actor
- The IP of the C2 server belongs to an ISP owned by Syrian Telecommunications Establishment, which is known for hosting infrastructure for SEA (Syrian Electronic Army), a Syrian state-backed hacking group.
- 22 APKs, in strings.xml files of the apps, refer to “Allosh”, a name associated with an SEA persona.
- The SEA recently claimed responsibility for DDoS attacks on Belgian media, and for defacing PayPal and eBay websites.
