Hackers Target Android Users via WhatsApp to Steal Sensitive Data

Researchers analyzed a malicious Android sample created using Spynote RAT, targeting high-value assets in Southern Asia, which, likely deployed by an unknown threat actor, aims to compromise sensitive information. 

Although the target’s precise location and nature have not been disclosed, its high-value nature suggests that advanced persistent threat (APT) groups may be interested in it. 

A targeted Android attack was launched against high-value individuals in southern Asia as the threat actor attempted a less-than-ideal delivery method via WhatsApp, deploying four obfuscated payloads with similar names.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

These payloads, once installed, quickly concealed themselves and operated silently in the background, communicating with a common C&C server, where the attacker’s intent was likely to compromise the victim’s device and potentially exfiltrate sensitive data.

Analysis of the decompiled payload reveals malicious functionalities. The AndroidManifest file requests permissions for accessing precise location (ACCESS_FINE_LOCATION), reading contacts (READ_CONTACTS), camera (CAMERA), SMS (READ_SMS), and external storage (WRITE_EXTERNAL_STORAGE). 

These permissions allow the attacker to track the user’s location, steal contacts, potentially take pictures or videos, intercept SMS messages, and potentially exfiltrate data from the device’s storage. 

It also demonstrates the app’s ability to interact with the file system, monitor phone calls, and retrieve the user’s precise location, which suggests the payload is designed for comprehensive data collection and espionage. 

The malicious code attempts to gain unauthorized access to sensitive device information by exploiting the device’s accessibility settings to monitor user activity, potentially capturing screen content and keystrokes. 

According to Cyfirma, it also extracts critical device details like the IMEI number, SIM information, Android version, network type, and IMSI, compromising the user’s privacy and security.

SpyNote, a sophisticated Remote Administration Tool (RAT), has been exploited by various threat actors, including APT groups like OilRig, APT-C-37, and OilAlpha, which have leveraged SpyNote to target critical sectors and individuals, compromising Android devices to steal data and maintain persistent access. 

The tool’s versatility and adaptability have made it a preferred choice for malicious actors, highlighting the evolving threat landscape and the need for robust security measures to counter such attacks. 

A high-value target in Southern Asia was attacked by an unidentified threat actor or an unknown APT group, where the attack employed the publicly available SpyNote malware, demonstrating the threat actor’s preference for this tool in targeting high-profile individuals.

Analyse Real-World Malware & Phishing Attacks With ANY.RUN - Get up to 3 Free Licenses