Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Android, BlackBerry Spyware Used in India Attacks

An advanced persistent threat (APT) actor responsible for stealing sensitive information from high profile targets in India leveraged Android and BlackBerry spyware in its attacks.

An advanced persistent threat (APT) actor responsible for stealing sensitive information from high profile targets in India leveraged Android and BlackBerry spyware in its attacks.

Trend Micro published a report last month on Operation C-Major, a campaign in which attackers managed to steal copies of passports and photo IDs, financial information, strategy and tactical documents, and personal photographs belonging to at least 160 Indian military officers, attachés and consultants.

Evidence suggests that the threat group, which stole gigabytes of information using unsophisticated malware and social engineering, is based in Pakistan.

Further analysis of Operation C-Major revealed that the attackers, active since at least early 2013, also used Android and BlackBerry mobile apps that allowed them to spy on victims. The applications, most of which are developed by a Pakistani firm, were advertised via Facebook and some of them even made their way to Google Play.

Researchers discovered that one of the individuals involved in the campaign actively promoted StealthGenie, a spying application capable of remotely monitoring calls, texts, videos and other communications on iOS, Android and BlackBerry devices. StealthGenie’s creator, Pakistani national Hammad Akbar, was arrested by United States authorities in 2014 and ordered to pay a fine of $500,000.

According to Trend Micro, Operation C-Major attackers leveraged an app similar to StealthGenie in 2013 to target BlackBerry phones. The fact that BlackBerry devices were targeted is not surprising considering the brand’s popularity within government agencies.

The BlackBerry malware used by the attackers can access a device’s GPS location, emails, contacts, calendar data and photos, and it can intercept emails, phone calls and messages. Researchers haven’t found any evidence that the BlackBerry spyware was ever available on BlackBerry World, which means attackers likely used social engineering to trick victims into installing it on their phones.

One of the Android spying apps used by the threat group is Ringster. The app, available on Google Play in the first half of 2015, is designed to take screenshots of the infected device and send them back to a server known to be used in Operation C-Major.

Advertisement. Scroll to continue reading.

A more advanced piece of spyware that was hosted on Google Play between June 2015 and March 2016 is SmeshApp, which can steal SMS messages, record videos and calls, and capture screenshots. The attackers have also used off-the-shelf mobile malware such as AndroRat.

Fake news apps capable of stealing SMSs and files, making videos, recording calls, and capturing screenshots were also leveraged by the group. The applications, called Indian Sena News, Bharatiya Sena News and India Defense News, were advertised on Facebook pages that had thousands of “likes.” For instance, the India Defense News (IDN) page had 1,200 likes, including from people with ties to the Indian army.

Related: Cybercriminals Target Bank Accounts of Firms in UK, US, India

Related: LeChiffre Ransomware Hits Indian Banks, Pharma Company

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.