Researchers identify targeted email attack distributing Android Trojan app

A recent targeted attack against human rights activists that used Android malware might be the first of many, they said

Security researchers from antivirus vendor Kaspersky Lab have identified a targeted email attack against human rights and political activists that distributed a custom Android Trojan app with information-stealing capabilities.

The attack was launched several days ago from the compromised email account of a high-profile Tibetan activist and is the first documented case of Android malware being used in such a targeted attack, the Kaspersky Lab researchers said Tuesday in a blog post.

Last year, researchers from antivirus vendor Trend Micro identified two Android backdoor apps associated with the Luckycat advanced persistent threat cyberespionage campaign that were in early development, but there was no evidence that they had actually been used, said Denis Maslennikov, a senior malware analyst at Kaspersky Lab. However, in this new case, there's real evidence of an Android Trojan app being used in a targeted attack, he said.

The hackers used the compromised email account to send a specially crafted email message with an .apk (Android application package) attachment to everyone in the victim's contact list, which most likely included many other activists.

The rogue message used a recent conference about human rights issues in China organized by the World Uyghur Congress (WUC) as lure. The conference was held earlier this month in Geneva and brought together Uyghur, Tibetan, Mongolian and Chinese human rights activists.

The same event was used as bait in a different email attack targeting multiple activist groups earlier this month. However, that attack targeted Windows users and distributed a malicious Excel file.

The new emails detected during the past several days claimed that the attached "WUC's Conference.apk" file contained a letter from the conference organizers. The attackers most likely counted on the fact that a lot of people read their email on their Android smart phones and are likely to click on the .apk file and install it, Maslennikov said.

The .apk file installs a Trojan app called "Conference" that displays a message about the conference attributed to Dolkun lsa, the chairman of the executive committee of the World Uyghur Congress. This is only used as a distraction, because in the background, the app reports the successful infection to a command-and-control server hosted in the U.S. and waits for SMS commands to start uploading data like contact details, call logs, text messages, geo-location and phone identification information.

Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.

Tibetan and Uyghur activists have previously been targeted in APT-style attacks that infected their computers with Windows or Mac remote access tools (RATs). However, this new attack might be the first in a future wave of targeted attacks against Android users, the Kaspersky researchers said.

While this particular operation used social engineering to distribute the Android malware, the researchers expect attackers to start using exploits for zero-day vulnerabilities or other techniques to infect Android devices in the future. "We are almost 100 percent sure that we'll see attacks using exploits to infect Android devices without any kind of user interaction in 2013, and not only targeted attacks, but also attacks launched by traditional cybercriminals," Maslennikov said.

Tags Dolkun lsasecuritytrend micromobile securityDenis Maslennikovspywarekaspersky labmalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Comments

Comments are now closed.

Latest News Articles

Most Popular Articles

Follow Us

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Resources

Best Deals on GoodGearGuide

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?