Researchers Find New Android Spyware Campaign Targeting Uyghur Community

guest · Sep 6, 2022

By Ravie Lakshmanan - September 6, 2022

A previously undocumented strain of Android spyware with extensive information gathering capabilities has been found disguised as a book likely designed to target the Uyghur community in China.

The malware comes under the guise of a book titled "The China Freedom Trap," a biography written by the exiled Uyghur leader Dolkun Isa.

"In light of the ongoing conflict between the Government of the People's Republic of China and the Uyghur community, the malware disguised as the book is a lucrative bait employed by threat actors (TAs) to spread malicious infection in the targeted community," cybersecurity firm Cyble said in a report published Monday.
Click to expand...

The existence of the malware samples, which come with the package name "com.emc.pdf," was first disclosed by researchers from the MalwareHunterTeam late last month.
Click to expand...

In reality, however, the malicious APK file is engineered to:
• hide the app icon,
• steal device and SIM information,
• steal SMS messages, contacts and call logs,
• identify neighboring cell information (received signal strength, Cell ID location),
• make calls and send SMSes on behalf of victims,
• delete SMS and call logs, and
• take pictures from the infected device's camera and capture its screen.
Click to expand...

Cyble: Spyware Campaign Targeting The Uyghur Community

Android Malware Disguised As “The China Freedom Trap” & Stealing Neighboring Cell Information
TAs are leveraging various methods, including regional and biogeographical conflicts, to fulfill their malicious intents. In this case, they are seen taking advantage of the Uyghur–Chinese conflict to target unsuspecting individuals.

According to our research, this type of malware is only distributed via sources other than Google Play Store. As a result, practicing basic cyber hygiene across mobile devices and online banking applications is a good way to prevent such malware from compromising your devices.
Click to expand...

guest · Nov 11, 2022

Experts Uncover Two Long-Running Android Spyware Campaigns Targeting Uyghurs
By Ravie Lakshmanan - November 11, 2022

Two long-running surveillance campaigns have been found targeting the Uyghur community in China and elsewhere with Android spyware tools designed to harvest sensitive information and track their whereabouts.
Click to expand...

This encompasses a previously undocumented malware strain called BadBazaar and updated variants of an espionage artifact dubbed MOONSHINE by researchers from the University of Toronto's Citizen Lab in September 2019.

"Mobile surveillance tools like BadBazaar and MOONSHINE can be used to track many of the 'pre-criminal' activities, actions considered indicative of religious extremism or separatism by the authorities in Xinjiang," Lookout said in a detailed write-up of the operations.
The BadBazaar campaign, according to the security firm, is said to date as far back as late 2018 and comprise 111 unique apps that masquerade as benign video players, messengers, religious apps, and even TikTok.
Click to expand...

Further analysis of BadBazaar's infrastructure has revealed overlaps with another spyware operation aimed at the ethnic minority that came to light in July 2020 and which made use of an Android toolset called DoubleAgent.

Attacks employing MOONSHINE, in a similar vein, have employed over 50 malicious apps since July 2022 that are engineered to amass personal data from the infected devices, in addition to recording audio and downloading arbitrary files.

"The majority of these samples are trojanized versions of popular social media platforms, like WhatsApp or Telegram, or trojanized versions of Muslim cultural apps, Uyghur-language tools, or prayer apps," the researchers said.
Click to expand...

The findings come a little over a month after Check Point disclosed details of another long-standing surveillanceware operation aimed at the Turkic Muslim community that deployed a trojan named MobileOrder since at least 2015.

"BadBazaar and these new variants of MOONSHINE add to the already extensive collection of unique surveillanceware used in campaigns to surveil and subsequently detain individuals in China," Lookout said.
Click to expand...

Lookout: Lookout Discovers Long-running Surveillance Campaigns Targeting Uyghurs

By Kristina Balaam, Alemdar Islamoglu, Justin Albrecht, Ruohan Xiong - November 10, 2022
Researchers from Lookout Threat Lab have uncovered two new surveillance campaigns targeting Uyghurs in the People’s Republic of China and abroad. One campaign introduces a novel Android surveillance tool we named BadBazaar that shares infrastructure with other previously encountered Uyghur-targeted tooling — as outlined in a 2020 whitepaper from the Lookout Threat Intelligence team. The other employs updated variants of a previously disclosed tool, MOONSHINE, discovered by Citizen Lab and observed to be targeting Tibetan activists in 2019.

BadBazaar and these new variants of MOONSHINE add to the already extensive collection of unique surveillanceware used in campaigns to surveil and subsequently detain individuals in China. Their continued development and their prevalence on Uyghur-language social media platforms indicate these campaigns are ongoing and that the threat actors have successfully infiltrated online Uyghur communities to distribute their malware.
Click to expand...

Log in or Sign up

Researchers Find New Android Spyware Campaign Targeting Uyghur Community

guest Guest

guest Guest

Log in or Sign up

Researchers Find New Android Spyware Campaign Targeting Uyghur Community

guest Guest

guest Guest

Useful Searches