BitterAPT: Evolution of an Android Espionage Tool – from open-source to custom RAT

guest · Jun 18, 2020

BitterAPT Revisited: the Untold Evolution of an Android Espionage Tool
June 18, 2020
https://labs.bitdefender.com/2020/0...ntold-evolution-of-an-android-espionage-tool/

In 2016, a sophisticated malware campaign targeting Pakistani nationals made headlines. Dubbed Bitter, the Advanced Persistent Threat group (also known as APT-C-08) has been active both in desktop and mobile malware campaigns for quite a long time, as their activity seems to date back to 2014.

The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions for Android (released in 2014) were based on the AndroRAT framework. Over time, they switched to a custom version that has been known as BitterRAT ever since.

This paper is a technical account of the developments related to Bitter, its evolution and how, steadily and surely, threat actors are raising their game and poking holes in Google Play to use the platform as a distribution channel.
Click to expand...

Whitepaper: https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf

Over the years, cross platform Android – Windows Bitter attribution has relied on the same domains being used by the malware in both scenarios, as well as by victimology [1][4]. The Bitter threat group has been using ArtraDownloader for its Windows campaign [10] and AndroRAT variations for its Android campaigns.

Worth mentioning is that the group has delivered malware for both Windows and Android via the same hacked sites.
The Bitter threat group is believed to operate out of a country in South Asia [6][12]. [...]
Click to expand...

guest · Aug 5, 2022

Meta: Bitter APT Espionage Attack Leveraged Apple’s TestFlight Service
August 4, 2022

Meta has cracked down on a cyber espionage operation where attackers convinced victims to download an iOS chat application via Apple’s legitimate TestFlight service, which is meant to help developers beta-test new applications.

The attackers, which Meta attributed to the known Bitter APT, operate out of South Asia and targeted victims in New Zealand, India, Pakistan and the UK with various social engineering tactics on social media platforms like Facebook with the end goal of deploying malware on their devices.
The use of real Apple services could aid attackers in bypassing detection and helping them to appear more legitimate, they said.

“This meant that hackers didn't need to rely on exploits to deliver custom malware to targets and could utilize official Apple services to distribute the app in an effort to make it appear more legitimate, as long as they convinced people to download Apple TestFlight and tricked them into installing their chat application,” according to Meta in its Quarterly Adversarial Threat Report, released Thursday.
Click to expand...

The Bitter APT group, which has been active since 2013, has previously targeted the energy, engineering and government sectors with RATs that were spread via spear-phishing emails or by the exploitation of known flaws.

TestFlight, currently owned by Apple, is only offered to developers within the iOS Developer Program, who can use it to test iOS, iPadOS, watchOS and tvOS apps before they are released to the App Store.
Click to expand...

The company found Bitter APT also using a variety of other tactics to target victims with malware, leveraging a mix of link-shortening services, compromised websites and third-party hosting providers. In one case, researchers found the APT using a new custom Android malware family, which they called Dracarys.

“Bitter injected Dracarys into trojanized (non-official) versions of YouTube, Signal, Telegram, WhatsApp, and custom chat applications capable of accessing call logs, contacts, files, text messages, geolocation, device information, taking photos, enabling microphone, and installing apps,” according to Meta. “While the malware functionality is fairly standard, as of this writing, malware and its supporting infrastructure has not been detected by existing public anti-virus systems.”
Click to expand...

Meta:
Quarterly Adversarial Threat Report (PDF): https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf

Bitter APT
We took action against a group of hackers — known in the security industry as Bitter APT — that operated out of South Asia, and targeted people in New Zealand, India, Pakistan and the United Kingdom.

While this group’s activity was relatively low in sophistication and operational security, it was persistent and well-resourced. Bitter used various malicious tactics to target people online with social engineering and infect their devices with malware. They used a mix of link-shortening services, malicious domains, compromised websites and third-party hosting providers to distribute their malware. Our platform was one of the elements of the broader cross-platform cyber espionage operation.
Click to expand...

guest · Aug 9, 2022

Hackers install Dracarys Android malware using modified Signal app
August 9, 2022

Researchers have discovered more details on the newly discovered Android spyware 'Dracarys,' used by the Bitter APT group in cyberespionage operations targeting users from New Zealand, India, Pakistan, and the United Kingdom.

Meta (Facebook) first reported the new Android malware in its Q2 2022 adversarial threat report, where they briefly mentioned its data-stealing, geo-locating, and microphone-activation capabilities.
Today, cyber-intelligence firm Cyble published a technical report on Dracarys, which was shared exclusively with Bleeping Computer, diving deeper into the inner workings of the spyware.
Click to expand...

Using Signal to deploy malware
While Meta mentions laced versions of Telegram, WhatsApp, and YouTube, Cyble's investigation only uncovered a trojanized version of the Signal messaging app.

As Signal's source code is open source, the Bitter APT hacking group was able to compile a version with all of the usual features and expected functionality. However, the threat actors also added the Dracarys malware to the source code when compiling the messaging app.
Click to expand...

Dracarys steals your data
When launched, Dracarys will connect to a Firebase server to receive commands on what data should be collected from the device.

The data that Dracarys can collect and transmit to the C2 server include the following: [...]
Finally, the spyware can capture screenshots from the device, record audio, and upload the media to the C2, which in the sample analyzed by Cyble was "hxxps://signal-premium-app[.]org".
Click to expand...

Cyble: Bitter APT Group Using “Dracarys” Android Spyware

Android Malware Disguised As A Messaging Application
During our routine threat hunting exercise, Cyble Research Labs came across an article wherein the researchers mentioned Bitter APT delivering the Android Spyware “Dracarys.” Bitter aka T-APT-17 is a well-known Advanced Persistent Threat (APT) group active since 2013 and operates in South Asia. It has been observed targeting China, India, Pakistan, and other countries in South Asia.

The Bitter APT is actively involved in both desktop and mobile malware campaigns and uses techniques like spear phishing emails, exploiting known vulnerabilities to deliver Remote Access Trojan (RAT) and other malware families.
Dracarys Android Spyware impersonates genuine applications such as Signal, Telegram, WhatsApp, YouTube, and other chat applications and distributes through phishing sites.
Click to expand...

Log in or Sign up

BitterAPT: Evolution of an Android Espionage Tool – from open-source to custom RAT

guest Guest

guest Guest

guest Guest

Log in or Sign up

BitterAPT: Evolution of an Android Espionage Tool – from open-source to custom RAT

guest Guest

guest Guest

guest Guest

Useful Searches