Virtual Event: Threat Detection and Incident Response Summit - Watch Sessions
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

New Android Spyware Uses Turla-Linked Infrastructure

Lab52 security researchers have dissected a new piece of Android malware that they discovered while analyzing infrastructure associated with Russian cyberespionage group Turla.

Lab52 security researchers have dissected a new piece of Android malware that they discovered while analyzing infrastructure associated with Russian cyberespionage group Turla.

While it’s the only malware family to connect to a specific IP address associated with Turla, the spyware can’t be attributed to the infamous APT, “given its threat capabilities,” Lab52 says.

Once installed on a victim’s phone, the malware poses as Process Manager and shows a gear-shaped icon. However, the icon is removed after the threat’s initial run.

When executed for the first time, the malware asks for an extensive set of permissions, which essentially provide it with full access to the device and user data.

The malware requests access to screen lock/unlock, device location, network settings, camera, audio settings, call logs, contacts, external storage, SMS messages, phone state, and audio recording, as well as permissions to set the device global proxy and display on the foreground.

[ READ: Over 100 Million Android Users Installed ‘Dark Herring’ Scamware ]

After the application has been configured, tasks are executed to steal data from the device and add it to a JSON. The malware also collects information on the installed packages and on the permissions the user has for each package.

Advertisement. Scroll to continue reading.

After collecting all of the needed information, the malware contacts its command and control (C&C) server, after which it sends the harvested data to the server.

The malware was also observed attempting to download and install an application called Rozdhan from a specific location. Also found in Google Play, the application is supposedly designed to help users earn money, which suggests that the attackers may attempt to use it as means to monetize the device access.

Related: Tens of Thousands Download “AbstractEmu” Android Rooting Malware

Related: ‘Xenomorph’ Android Trojan Targets 56 Banking Applications

Related: Fake Netflix App Luring Android Users to Malware

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.