Sophisticated new Russian spyware hides in functional fake apps
A new form of Android spyware embedded in functional fake apps is one of the most sophisticated ever seen, according to a new report today.
Discovered by cybersecurity researchers at Lookout Inc. and dubbed “Monokle,” the spyware is said to have been developed by Russia-based company Special Technology Centre Ltd., which was sanctioned by the U.S. government in connection to alleged interference in the 2016 presidential elections.
The spyware toolset, which is believed to have been developed as far back as 2015, was first observed in the wild in 2016, with infections peaking in 2018, but until recently it had not been identified.
The infection path for Monokle is trojanized versions of what are designed to look like legitimate apps. Following a recent trend in malware, the trojanized apps operate as intended, with the spyware operating in the background. That means the victims are not aware that they have malicious apps and because the apps work, they’re far less unlikely to uninstall them.
Many of the apps discovered by the researchers primarily targeted users in the Caucasus region and well as users in and around Syria, but some apps popular in the west were found copied and trojanized as well. Some of the fake apps found included those for Skype, Signal and Pornhub.
Once a user installs the fake but functional app, Monokle gets to work. In its first stage, the spyware enables so-called man-in-the-middle attacks by allowing those behind it to install their own malicious certificates on the infected device. That’s a unique feature, according to the researchers.
After that, Monokle’s features read like a shopping list of just about every known form of surveillance. The spyware can harvest and exfiltrate data from many popular applications; record users’ device screens to capture their PINs, patterns and passwords; steal contacts, call histories, browser histories and calendar information; record calls and local audio; capture user passwords of websites; retrieve emails, take screenshots, track the location of a device; and more.
“Monokle is a great example of the larger trend of enterprises and nation-states developing sophisticated mobile malware that we have observed over the years,” the researchers noted in a blog post.
Since you’re here …
Show your support for our mission with our one-click subscription to our YouTube channel (below). The more subscribers we have, the more YouTube will suggest relevant enterprise and emerging technology content to you. Thanks!
Support our mission: >>>>>> SUBSCRIBE NOW >>>>>> to our YouTube channel.
… We’d also like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.