Thursday, March 28, 2024

Russia Linked Android Malware Access Camera, Audio & Location

Hacking group Turla is part of the Russian intelligence service that utilizes custom malware to perform cyberespionage mainly to target systems and entities from:-

  • Europe
  • America

It may be the Turla hacking group that is responsible for the widespread distribution of infamous malware on Android devices.

This malware not only allows hackers to gather information about you but also allows them access to your phone’s other important features as well. While in December 2020, these threat actors were implicated in the SolarWinds supply chain attack using the Sunburst backdoor.

Turla Group’s Android Spyware

Lab52 experts have found an APK that is dubbed “Process Manager,” it functions as an Android spyware application that uploads all the sensitive data to the server controlled by the threat actors to propagate the malicious code.

Process Manager hides on Android devices using a gear-shaped icon that looks like a system component, pretending that it is part of the operating system. So, currently, it is not entirely clear how the spyware is distributed.

Permissions accessed

In order for this app to function, your Android device needs to grant it 18 permissions, and here below we have mentioned all the permissions:-

  • Access coarse location
  • Access fine location
  • Access network state
  • Access WiFi state
  • Camera
  • Foreground service
  • Internet
  • Modify audio settings
  • Read call log
  • Read contacts
  • Read external storage
  • Write external storage
  • Read phone state
  • Read SMS
  • Receive boot completed
  • Record audio
  • Send SMS
  • Wake log

There is a high risk that your device will be tracked according to user permissions if all permissions are allowed. Moreover, the Android spyware is likely to continue to operate silently in the background, once the permissions have been granted by the user.

By exploiting all these permissions, hackers can access sensitive data like:-

  • Confidential information related to bank accounts. 
  • Email addresses.
  • Saved username & passwords.
  • Messages
  • Event notifications.
  • Logs.
  • Recordings.

A JSON file containing all this information was sent to 82.146.35.240, which is the main command and control server of the threat actors.

Abuse For Profit

On the Google Play Store, you can find the app “RozDhan: Earn Wallet Cash” that has more than 10,000,000 downloads, and it is being abused for profit. While the Lab52 team discovered that the app downloads additional payloads to the device.

It is likely to earn a commission through the referral system of the application, the spyware downloads the APK for you. However, it is somewhat strange that it appears to be the particular actor focused on cyber-espionage rather than just general hacking.

While it is always advisable for Android users to be cautious when downloading apps to their smartphone. Moreover, the app permissions should be reviewed periodically to ensure that they are not putting the privacy and security of the user at risk.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles