Android, BlackBerry Spyware Used in India Attacks

An advanced persistent threat (APT) actor responsible for stealing sensitive information from high profile targets in India leveraged Android and BlackBerry spyware in its attacks.

Trend Micro published a report last month on Operation C-Major, a campaign in which attackers managed to steal copies of passports and photo IDs, financial information, strategy and tactical documents, and personal photographs belonging to at least 160 Indian military officers, attachés and consultants.

Evidence suggests that the threat group, which stole gigabytes of information using unsophisticated malware and social engineering, is based in Pakistan.

Further analysis of Operation C-Major revealed that the attackers, active since at least early 2013, also used Android and BlackBerry mobile apps that allowed them to spy on victims. The applications, most of which are developed by a Pakistani firm, were advertised via Facebook and some of them even made their way to Google Play.

Researchers discovered that one of the individuals involved in the campaign actively promoted StealthGenie, a spying application capable of remotely monitoring calls, texts, videos and other communications on iOS, Android and BlackBerry devices. StealthGenie’s creator, Pakistani national Hammad Akbar, was arrested by United States authorities in 2014 and ordered to pay a fine of $500,000.

According to Trend Micro, Operation C-Major attackers leveraged an app similar to StealthGenie in 2013 to target BlackBerry phones. The fact that BlackBerry devices were targeted is not surprising considering the brand’s popularity within government agencies.

The BlackBerry malware used by the attackers can access a device’s GPS location, emails, contacts, calendar data and photos, and it can intercept emails, phone calls and messages. Researchers haven’t found any evidence that the BlackBerry spyware was ever available on BlackBerry World, which means attackers likely used social engineering to trick victims into installing it on their phones.

One of the Android spying apps used by the threat group is Ringster. The app, available on Google Play in the first half of 2015, is designed to take screenshots of the infected device and send them back to a server known to be used in Operation C-Major.

A more advanced piece of spyware that was hosted on Google Play between June 2015 and March 2016 is SmeshApp, which can steal SMS messages, record videos and calls, and capture screenshots. The attackers have also used off-the-shelf mobile malware such as AndroRat.

Fake news apps capable of stealing SMSs and files, making videos, recording calls, and capturing screenshots were also leveraged by the group. The applications, called Indian Sena News, Bharatiya Sena News and India Defense News, were advertised on Facebook pages that had thousands of “likes.” For instance, the India Defense News (IDN) page had 1,200 likes, including from people with ties to the Indian army.

Related: Cybercriminals Target Bank Accounts of Firms in UK, US, India

Related: LeChiffre Ransomware Hits Indian Banks, Pharma Company