New Variants of Android Spyware Linked to APT C-23 Enhanced for Stealth and Persistence, Sophos Research Reveals

OXFORD, United Kingdom, Nov. 23, 2021 (GLOBE NEWSWIRE) — Sophos, a global leader in next-generation cybersecurity, has published, “Android APT Spyware, Targeting Middle East Victims, Enhances Evasiveness,” detailing new variants of Android spyware linked to C-23, an advanced persistent threat (APT) adversary that has been active in the Middle East since 2017. The new variants are enhanced for stealth and persistence.

The spyware presents itself as an update app with a generic icon and name, such as “App Updates.” Sophos researchers believe the attackers distribute the spyware app by sending a download link in the form of a text message to the target’s phone. The first time a target runs the spyware app, it asks for permissions to control various aspects of the phone. The attackers use social engineering techniques to convince the target these permissions are essential for the app to function. After the target has granted the necessary rights, the spyware then disguises itself using the name and icon of a legitimate app. This makes it harder for the phone’s user to find and manually remove the spyware.

The New Variants

The new variants use more, and more varied, disguises than previous versions, hiding behind popular app icons such as Chrome, Google, Google Play, YouTube, or the BOTIM voice-over-IP service. If targets click a fraudulent icon, the spyware launches the legitimate version of the app, while maintaining surveillance in the background. 

Previous versions of the spyware relied on a single command-and-control domain that was hardcoded into the app and operated by the attackers. If a defender found and took down the domain, the spyware was disabled. Sophos researchers believe that the attackers have tried to address this potential point of weakness in the new variants, which can switch the command-and-control server to a different domain. This allows the spyware to continue operating even after a domain takedown. 

The new variants share code with other malware samples attributed to APT C-23. Sophos researchers also found Arabic language strings in the code and observed that some of the text could be presented in either English or Arabic, depending on the language setting of a victim’s phone.

Nefarious features from previous versions of the spyware remain unchanged, such as: collecting text from SMS or other apps, contacts, call logs, images, and documents; recording ambient audio and incoming and outgoing calls, including WhatsApp calls; taking pictures and screen shots using a phone’s camera and recording videos of the screen; reading notifications from social media and messaging apps; and canceling notifications from built-in security apps, as well as from Android system apps. The spyware can also supress its own notifications.

“Spyware is a growing threat in an increasingly connected world,” said Pankaj Kohli, threat researcher at Sophos. “The Android spyware linked to APT C-23 has been around for at least four years, and attackers continue to develop it with new techniques that evade detection and removal. The attackers also use social engineering to lure victims into granting the permissions needed to see into every corner of their digital life. Fortunately, there are practical steps that people can take to protect against spyware and many of them are worth applying even if users don’t believe they’re a target for surveillance.”

Sophos recommends the following actions for anyone concerned about spyware or Potentially Unwanted Applications (PUAs):

• Users should be wary of apps asking for sensitive permissions, such as device admin or notification access, or those requiring superuser/root access. Users can view apps with device admin and notification access permissions by browsing “Settings” and searching for “device admin apps” and “notification access,” respectively
• The sudden disappearance of an app icon after running it for the first time, which is often an indicator of an unwanted or malicious application
• Targets of this family of spyware can remove the apps manually by navigating to the list of installed apps, selecting “Settings->Apps”and then scrolling to find the name the app used when it was first installed (such as “App Updates,” “System Apps Updates” or “Android Update Intelligence”)
• However, many other forms of mobile malware conceal themselves from the list of installed apps. To remove these, users need the help of an anti-malware application
• Sophos also advises users to install a mobile security solution, such as Intercept X for Mobile, to automatically detect spyware and malware
• To avoid falling prey to malicious apps, users should only install mobile apps from trusted sources, such as Google Play. Update Android OS and other apps via Android Settings and Google Play respectively, instead of relying on third parties

SophosLabs has published indicators of compromise on its Github page.

To learn more about the Android spyware, read the article on SophosLabs Uncut.

Additional Resources

• Further details on cyberthreats targeting mobile devices can be found in the mobile malware section in the Sophos 2022 Threat Report
• Tactics, techniques, and procedures (TTPs) and more for different types of threats are available on SophosLab Uncut, which provides Sophos’ latest threat intelligence
• Information on attacker behaviors, incident reports and advice for security operations professionals is available on Sophos News SecOps
• Learn more about Sophos’ Rapid Response service that contains, neutralizes and investigates attacks 24/7
• The four top tips for responding to a security incident from Sophos Rapid Response and the Managed Threat Response Team
• Read the latest security news and views on Sophos’ award-winning news website Naked Security and on Sophos News

About Sophos
Sophos is a worldwide leader in next-generation cybersecurity, protecting more than 500,000 organizations and millions of consumers in more than 150 countries from today’s most advanced cyberthreats. Powered by threat intelligence, AI and machine learning from SophosLabs and SophosAI, Sophos delivers a broad portfolio of advanced products and services to secure users, networks and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. Sophos provides a single integrated cloud-based management console, Sophos Central – the centerpiece of an adaptive cybersecurity ecosystem that features a centralized data lake that leverages a rich set of open APIs available to customers, partners, developers, and other cybersecurity vendors. Sophos sells its products and services through reseller partners and managed service providers (MSPs) worldwide. Sophos is headquartered in Oxford, U.K. More information is available at www.sophos.com.

CONTACT: Contact Info: Samantha Powers [email protected]

Disclaimer: This content is distributed by The GlobeNewswire