APT-C-23 has Re-Emerged on the Front Scene

mood · May 19, 2020

APT-C-23 has Re-Emerged on the Front Scene with “Mygram” Hacks
May 18, 2020
https://www.technadu.com/apt-c-23-re-emerged-front-scene-mygram-hacks/102145/

Researchers from the “360 Threat Intelligence Center” have caught APT-C-23 activity on their radars, and are now reporting about their findings in detail. The hacking group, which is also known as “Two-Tailed Scorpion”, has been targeting the Israel Defense Forces (IDF) since February 2020, using an instant message app called “Mygram” as a bait.

The website that distributes “Mygram IM” is well-crafted, containing detailed descriptions of the features of the chat app, and thus it’s pretty convincing.
Thus, the website is fabricated, but not obviously.

The malware is also capable of receiving Firebase Cloud Messaging commands and functions encoded with Base64. As the researchers point out, the actors are using multiple different spyware versions on their campaigns, switching from one method to the other. However, everything features the same or at least similar code structure.
Click to expand...

We have seen Hamas hackers targeting Israeli soldiers with fake IM apps and nicely crafted phishing messages back in February, and the latest reports about the APT-C-23 activity coincide with that time period. The apps that were used then had the names “GrixyApp,” “ZatuApp,” and “Catch&See”, and they were all distributed via nicely crafted phishing websites.

Thus, we can now safely assume that APT-C-23 was behind these attacks too.
Click to expand...

mood · Oct 1, 2020

Fake Threema, Telegram apps hide spyware for targeted attacks
October 1, 2020
https://www.bleepingcomputer.com/ne...egram-apps-hide-spyware-for-targeted-attacks/

Starting from a little-known malware sample, security researchers tracked down a new Android spyware distributed through fake messaging apps like Threema, Telegram, and WeMessage.

The malware is from APT-C-23, a group of advanced hackers running espionage campaigns against military and educational institutions since before July 2015.
Hiding in fake apps
In April 2020, security researcher MalwareHunterTeam tweeted about a piece of spyware for Android that had a very low detection rate on VirusTotal. Examining the sample, researchers at ESET discovered that it was part of the malware toolkit used by the APT-C-23 threat actor.
About two months later, in, June, MalwareHunterTeam found a new sample of the same malware hidden in the installation file of the Telegram messaging app available from DigitalApps, an unofficial Android store.
Click to expand...

Improved set of features
The APT-C-23 is tracked under different names (Big Bang APT, Two-tailed Scorpion) by other cybersecurity companies. The group deploys malware for Windows (KasperAgent, Micropsia) and Android (GnatSpy, Vamp, FrozenCell) platforms [1, 2, 3, 4, 5], attacking targets in the Middle East.

ESET observed that the list of features now includes the possibility to silence notifications from security apps integrated with devices from Samsung, Xiaomi, and Huawei, allowing it to stay hidden even if its activity is detected.
ESET published a technical report detailing the new capabilities of the improved spyware from APT-C-23, which provides useful indicators of compromise.
Click to expand...

ESET: APT‑C‑23 group evolves its Android spyware

The APT-C-23 group is known to have used both Windows and Android components in its operations, with the Android components first described in 2017. In the same year, multiple analyses of APT-C-23’s mobile malware were published.

Compared to the versions documented in 2017, Android/SpyC23.A has extended spying functionality, including reading notifications from messaging apps, call recording and screen recording, and new stealth features, such as dismissing notifications from built-in Android security apps. One of the ways the spyware is distributed is via a fake Android app store, using well-known apps as a lure.
Click to expand...

Log in or Sign up

APT-C-23 has Re-Emerged on the Front Scene

mood Updates Team

mood Updates Team

Log in or Sign up

APT-C-23 has Re-Emerged on the Front Scene

mood Updates Team

mood Updates Team

Useful Searches