Researchers identify targeted email attack distributing Android Trojan app

A recent targeted attack against human rights activists that used Android malware might be the first of many, they said

Security researchers from antivirus vendor Kaspersky Lab have identified a targeted email attack against human rights and political activists that distributed a custom Android Trojan app with information-stealing capabilities.

The attack was launched several days ago from the compromised email account of a high-profile Tibetan activist and is the first documented case of Android malware being used in such a targeted attack, the Kaspersky Lab researchers said Tuesday in a blog post.

Last year, researchers from antivirus vendor Trend Micro identified two Android backdoor apps associated with the Luckycat advanced persistent threat cyberespionage campaign that were in early development, but there was no evidence that they had actually been used, said Denis Maslennikov, a senior malware analyst at Kaspersky Lab. However, in this new case, there's real evidence of an Android Trojan app being used in a targeted attack, he said.

The hackers used the compromised email account to send a specially crafted email message with an .apk (Android application package) attachment to everyone in the victim's contact list, which most likely included many other activists.

The rogue message used a recent conference about human rights issues in China organized by the World Uyghur Congress (WUC) as lure. The conference was held earlier this month in Geneva and brought together Uyghur, Tibetan, Mongolian and Chinese human rights activists.

The same event was used as bait in a different email attack targeting multiple activist groups earlier this month. However, that attack targeted Windows users and distributed a malicious Excel file.

The new emails detected during the past several days claimed that the attached "WUC's Conference.apk" file contained a letter from the conference organizers. The attackers most likely counted on the fact that a lot of people read their email on their Android smart phones and are likely to click on the .apk file and install it, Maslennikov said.

The .apk file installs a Trojan app called "Conference" that displays a message about the conference attributed to Dolkun lsa, the chairman of the executive committee of the World Uyghur Congress. This is only used as a distraction, because in the background, the app reports the successful infection to a command-and-control server hosted in the U.S. and waits for SMS commands to start uploading data like contact details, call logs, text messages, geo-location and phone identification information.

Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.

Tibetan and Uyghur activists have previously been targeted in APT-style attacks that infected their computers with Windows or Mac remote access tools (RATs). However, this new attack might be the first in a future wave of targeted attacks against Android users, the Kaspersky researchers said.

While this particular operation used social engineering to distribute the Android malware, the researchers expect attackers to start using exploits for zero-day vulnerabilities or other techniques to infect Android devices in the future. "We are almost 100 percent sure that we'll see attacks using exploits to infect Android devices without any kind of user interaction in 2013, and not only targeted attacks, but also attacks launched by traditional cybercriminals," Maslennikov said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Dolkun lsatrend microsecuritymobile securityspywareDenis Maslennikovmalwarekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?