Researchers identify targeted email attack distributing Android Trojan app
A recent targeted attack against human rights activists that used Android malware might be the first of many, they said
IDG News Service - Security researchers from antivirus vendor Kaspersky Lab have identified a targeted email attack against human rights and political activists that distributed a custom Android Trojan app with information-stealing capabilities.
The attack was launched several days ago from the compromised email account of a high-profile Tibetan activist and is the first documented case of Android malware being used in such a targeted attack, the Kaspersky Lab researchers said Tuesday in a blog post.
Last year, researchers from antivirus vendor Trend Micro identified two Android backdoor apps associated with the Luckycat advanced persistent threat cyberespionage campaign that were in early development, but there was no evidence that they had actually been used, said Denis Maslennikov, a senior malware analyst at Kaspersky Lab. However, in this new case, there's real evidence of an Android Trojan app being used in a targeted attack, he said.
The hackers used the compromised email account to send a specially crafted email message with an .apk (Android application package) attachment to everyone in the victim's contact list, which most likely included many other activists.
The rogue message used a recent conference about human rights issues in China organized by the World Uyghur Congress (WUC) as lure. The conference was held earlier this month in Geneva and brought together Uyghur, Tibetan, Mongolian and Chinese human rights activists.
The same event was used as bait in a different email attack targeting multiple activist groups earlier this month. However, that attack targeted Windows users and distributed a malicious Excel file.
The new emails detected during the past several days claimed that the attached "WUC's Conference.apk" file contained a letter from the conference organizers. The attackers most likely counted on the fact that a lot of people read their email on their Android smart phones and are likely to click on the .apk file and install it, Maslennikov said.
The .apk file installs a Trojan app called "Conference" that displays a message about the conference attributed to Dolkun lsa, the chairman of the executive committee of the World Uyghur Congress. This is only used as a distraction, because in the background, the app reports the successful infection to a command-and-control server hosted in the U.S. and waits for SMS commands to start uploading data like contact details, call logs, text messages, geo-location and phone identification information.
Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Malware and Vulnerabilities White Papers | Webcasts