APT-C-23 has Re-Emerged on the Front Scene

mood · May 19, 2020

APT-C-23 has Re-Emerged on the Front Scene with “Mygram” Hacks
May 18, 2020
https://www.technadu.com/apt-c-23-re-emerged-front-scene-mygram-hacks/102145/

Researchers from the “360 Threat Intelligence Center” have caught APT-C-23 activity on their radars, and are now reporting about their findings in detail. The hacking group, which is also known as “Two-Tailed Scorpion”, has been targeting the Israel Defense Forces (IDF) since February 2020, using an instant message app called “Mygram” as a bait.

The website that distributes “Mygram IM” is well-crafted, containing detailed descriptions of the features of the chat app, and thus it’s pretty convincing.
Thus, the website is fabricated, but not obviously.

The malware is also capable of receiving Firebase Cloud Messaging commands and functions encoded with Base64. As the researchers point out, the actors are using multiple different spyware versions on their campaigns, switching from one method to the other. However, everything features the same or at least similar code structure.
Click to expand...

We have seen Hamas hackers targeting Israeli soldiers with fake IM apps and nicely crafted phishing messages back in February, and the latest reports about the APT-C-23 activity coincide with that time period. The apps that were used then had the names “GrixyApp,” “ZatuApp,” and “Catch&See”, and they were all distributed via nicely crafted phishing websites.

Thus, we can now safely assume that APT-C-23 was behind these attacks too.
Click to expand...

mood · Oct 1, 2020

Fake Threema, Telegram apps hide spyware for targeted attacks
October 1, 2020
https://www.bleepingcomputer.com/ne...egram-apps-hide-spyware-for-targeted-attacks/

Starting from a little-known malware sample, security researchers tracked down a new Android spyware distributed through fake messaging apps like Threema, Telegram, and WeMessage.

The malware is from APT-C-23, a group of advanced hackers running espionage campaigns against military and educational institutions since before July 2015.
Hiding in fake apps
In April 2020, security researcher MalwareHunterTeam tweeted about a piece of spyware for Android that had a very low detection rate on VirusTotal. Examining the sample, researchers at ESET discovered that it was part of the malware toolkit used by the APT-C-23 threat actor.
About two months later, in, June, MalwareHunterTeam found a new sample of the same malware hidden in the installation file of the Telegram messaging app available from DigitalApps, an unofficial Android store.
Click to expand...

Improved set of features
The APT-C-23 is tracked under different names (Big Bang APT, Two-tailed Scorpion) by other cybersecurity companies. The group deploys malware for Windows (KasperAgent, Micropsia) and Android (GnatSpy, Vamp, FrozenCell) platforms [1, 2, 3, 4, 5], attacking targets in the Middle East.

ESET observed that the list of features now includes the possibility to silence notifications from security apps integrated with devices from Samsung, Xiaomi, and Huawei, allowing it to stay hidden even if its activity is detected.
ESET published a technical report detailing the new capabilities of the improved spyware from APT-C-23, which provides useful indicators of compromise.
Click to expand...

ESET: APT‑C‑23 group evolves its Android spyware

The APT-C-23 group is known to have used both Windows and Android components in its operations, with the Android components first described in 2017. In the same year, multiple analyses of APT-C-23’s mobile malware were published.

Compared to the versions documented in 2017, Android/SpyC23.A has extended spying functionality, including reading notifications from messaging apps, call recording and screen recording, and new stealth features, such as dismissing notifications from built-in Android security apps. One of the ways the spyware is distributed is via a fake Android app store, using well-known apps as a lure.
Click to expand...

mood · Oct 27, 2021

Android spyware apps target Israel in three-year-long campaign
October 27, 2021
https://www.bleepingcomputer.com/ne...ps-target-israel-in-three-year-long-campaign/

A set of seemingly innocuous Android apps have been infecting Israeli users with spyware since 2018, and the campaign continues to this day.

The spyware-laden apps were discovered by researchers at Qihoo 360 who found various apps disguised as social applications, Threema, Al-Aqsa Radio, Al-Aqsa Mosque, Jerusalem Guide, PDF viewer, Wire, and other applications.
The most abused app is one pretending to be Threema, an end-to-end encrypted instant messaging application.
Click to expand...

Extensive spyware set
The researchers analyzed various samples and found that the attackers use a wide range of different commodity malware for these attacks, including SpyNote, Mobihok, WH-RAT, and 888RAT.
Signs of Hamas hackers
Qihoo 360 believes that ‘APT-C-23’, a Hamas-backed group, is behind the attacks and has been repeatedly linked with past Israel-targeting campaigns.

In October 2020, they were uncovered for using Android spyware disguised as Threema and Telegram against devices in Israel.
A few months earlier, they baited Israeli soldiers through custom spyware apps made to appear as legit dating apps.
Click to expand...

For this campaign, which has been going on for three years, the researchers note that the attribution may be thin, but the similarities with previous APT-C-23 campaigns are strong.

If you have downloaded Threema, Telegram, PDF viewer, Al-Aqsa Radio, Al-Aqsa Mosque, and Jerusalem Guide from any site other than the Google Play Store, it is advised that you remove the app immediately and scan your device with an antivirus program.
Click to expand...

mood · Nov 24, 2021

APT C-23 Hackers Using New Android Spyware Variant to Target Middle East Users
November 24, 2021
https://thehackernews.com/2021/11/apt-c-23-hackers-using-new-android.html

A threat actor known for striking targets in the Middle East has evolved its Android spyware yet again with enhanced capabilities that allow it to be stealthier and more persistent while passing off as seemingly innocuous app updates to stay under the radar.

The new variants have "incorporated new features into their malicious apps that make them more resilient to actions by users, who might try to remove them manually, and to security and web hosting companies that attempt to block access to, or shut down, their command-and-control server domains," Sophos threat researcher Pankaj Kohli said in a report published Tuesday.
Click to expand...

Also known by the monikers VAMP, FrozenCell, GnatSpy, and Desert Scorpion, the mobile spyware has been a preferred tool of choice for the APT-C-23 threat group since at least 2017, with successive iterations featuring extended surveillance functionality to vacuum files, images, contacts and call logs, read notifications from messaging apps, record calls (including WhatsApp), and dismiss notifications from built-in Android security apps.

It's believed that the attackers deliver the spyware app by sending a download link to the targets through smishing messages.
Click to expand...

Sophos: Android APT spyware, targeting Middle East victims, enhances evasiveness

The phone spyware has new features that confer resistance to takedowns or manual removal
Click to expand...

Log in or Sign up

APT-C-23 has Re-Emerged on the Front Scene

mood Updates Team

mood Updates Team

mood Updates Team

mood Updates Team