Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Android, BlackBerry Spyware Used in India Attacks

An advanced persistent threat (APT) actor responsible for stealing sensitive information from high profile targets in India leveraged Android and BlackBerry spyware in its attacks.

An advanced persistent threat (APT) actor responsible for stealing sensitive information from high profile targets in India leveraged Android and BlackBerry spyware in its attacks.

Trend Micro published a report last month on Operation C-Major, a campaign in which attackers managed to steal copies of passports and photo IDs, financial information, strategy and tactical documents, and personal photographs belonging to at least 160 Indian military officers, attachés and consultants.

Evidence suggests that the threat group, which stole gigabytes of information using unsophisticated malware and social engineering, is based in Pakistan.

Further analysis of Operation C-Major revealed that the attackers, active since at least early 2013, also used Android and BlackBerry mobile apps that allowed them to spy on victims. The applications, most of which are developed by a Pakistani firm, were advertised via Facebook and some of them even made their way to Google Play.

Researchers discovered that one of the individuals involved in the campaign actively promoted StealthGenie, a spying application capable of remotely monitoring calls, texts, videos and other communications on iOS, Android and BlackBerry devices. StealthGenie’s creator, Pakistani national Hammad Akbar, was arrested by United States authorities in 2014 and ordered to pay a fine of $500,000.

According to Trend Micro, Operation C-Major attackers leveraged an app similar to StealthGenie in 2013 to target BlackBerry phones. The fact that BlackBerry devices were targeted is not surprising considering the brand’s popularity within government agencies.

The BlackBerry malware used by the attackers can access a device’s GPS location, emails, contacts, calendar data and photos, and it can intercept emails, phone calls and messages. Researchers haven’t found any evidence that the BlackBerry spyware was ever available on BlackBerry World, which means attackers likely used social engineering to trick victims into installing it on their phones.

One of the Android spying apps used by the threat group is Ringster. The app, available on Google Play in the first half of 2015, is designed to take screenshots of the infected device and send them back to a server known to be used in Operation C-Major.

A more advanced piece of spyware that was hosted on Google Play between June 2015 and March 2016 is SmeshApp, which can steal SMS messages, record videos and calls, and capture screenshots. The attackers have also used off-the-shelf mobile malware such as AndroRat.

Fake news apps capable of stealing SMSs and files, making videos, recording calls, and capturing screenshots were also leveraged by the group. The applications, called Indian Sena News, Bharatiya Sena News and India Defense News, were advertised on Facebook pages that had thousands of “likes.” For instance, the India Defense News (IDN) page had 1,200 likes, including from people with ties to the Indian army.

Related: Cybercriminals Target Bank Accounts of Firms in UK, US, India

Related: LeChiffre Ransomware Hits Indian Banks, Pharma Company

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

South Dakota Gov. Kristi Noem says her personal cell phone was hacked and linked it to the release of documents by the January 6...


A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Chinese tech giant Huawei patched nearly 300 vulnerabilities in its HarmonyOS operating system in 2022.