StrongPity APT Group Deploys Android Malware for the First Time

guest · Jul 22, 2021

APT Hackers Distributed Android Trojan via Syrian e-Government Portal
July 22, 2021
https://thehackernews.com/2021/07/apt-hackers-distributed-android-trojan.html

An advanced persistent threat (APT) actor has been tracked in a new campaign deploying Android malware via the Syrian e-Government Web Portal, indicating an upgraded arsenal designed to compromise victims.

"To the best of our knowledge, this is the first time that the group has been publicly observed using malicious Android applications as part of its attacks," Trend Micro researchers Zhengyu Dong, Fyodor Yarochkin, and Steven Du said in a technical write-up published Wednesday.
StrongPity, also codenamed Promethium by Microsoft, is believed to have been active since 2002 and has typically focused on targets across Turkey and Syria. In June 2020, the espionage threat actor was connected to a wave of activities that banked on watering hole attacks and tampered installers, which abuse the popularity of legitimate applications, to infect targets with malware.
Click to expand...

The latest operation is no different in that it underscores the threat actor's propensity towards repackaging benign applications into trojanized variants to facilitate the attacks.

The malware, masquerading as the Syrian e-Gov Android application, is said to have been created in May 2021, with the app's manifest file ("AndroidManifest.xml") modified to explicitly request additional permissions on the phone, including the ability to read contacts, write to external storage, keep the device awake, access information about cellular and Wi-Fi networks, precise location, and even allow the app to have itself started as soon as the system has finished booting.
Click to expand...

Despite no known public reports of StrongPity using malicious Android applications in their attacks, Trend Micro's attribution to the adversary stems from the use of a C2 server that has previously been used in intrusions linked to the hacking group, notably a malware campaign documented by AT&T's Alien Labs in July 2019 that leveraged tainted versions of the WinBox router management software, WinRAR, and other trusted utilities to breach targets.
Click to expand...

Trend Micro: StrongPity APT Group Deploys Android Malware for the First Time

We recently conducted an investigation into a malicious Android malware sample, which we believe can be attributed to the StrongPity APT group, that was posted on the Syrian e-Gov website. To the best of our knowledge, this is the first time that the group has been publicly observed using malicious Android applications as part of its attacks.

This investigation has provided evidence to attribute the Android malware sample, which was posted on the Syrian e-Gov website, to the StrongPity threat group. We were also able to identify additional Android trojan files and correlate these malicious Android applications with existing public reports based on their similarities to the threat actor’s TTPs and network infrastructure they used.
Click to expand...

guest · Jan 10, 2023

Hackers target Android users with fake Shagle video-chat app
By Bill Toulas @billtoulas - January 10, 2023

The StrongPity APT hacking group is distributing a fake Shagle chat app that is a trojanized version of the Telegram for Android app with an added backdoor.
Click to expand...

Shagle is a legitimate random-video-chat platform allowing strangers to talk via an encrypted communications channel. However, the platform is entirely web-based, not offering a mobile app.

StrongPity has been found using a fake website since 2021 that impersonates the actual Shagle site to trick victims into downloading a malicious Android.
Once installed, this app enables the hackers to conduct espionage on the targeted victims, including monitoring phone calls, collecting SMS texts, and grabbing contact lists.
Click to expand...

The latest StrongPity activity was discovered by ESET researchers who attributed the campaign to the espionage APT group based on code similarities with past payloads.
Additionally, the Android app is signed with the same certificate the APT used to sign an app that mimicked the Syrian e-gov Android application in a 2021 campaign.
Trojanizing the Android Telegram app
The malicious Android application distributed by StrongPity is an APK file named "video.apk," the standard Telegram v7.5.0 (February 2022) app modified to impersonate a Shagle mobile app.

ESET couldn't determine how victims arrive on the fake Shagle website, but it's likely through spear phishing emails, smishing (SMS phishing), or instant messages on online platforms.
Click to expand...

ESET: StrongPity espionage campaign targeting Android users

By Lukas Stefanko @LukasStefanko - January 10, 2023
ESET researchers identified an active StrongPity campaign distributing a trojanized version of the Android Telegram app, presented as the Shagle app – a video-chat service that has no app version
Click to expand...

Log in or Sign up

StrongPity APT Group Deploys Android Malware for the First Time

guest Guest

guest Guest

Log in or Sign up

StrongPity APT Group Deploys Android Malware for the First Time

guest Guest

guest Guest

Useful Searches