We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Researchers identify targeted email attack distributing Android Trojan app

A recent targeted attack against human rights activists that used Android malware might be the first of many, they said

Security researchers from antivirus vendor Kaspersky Lab have identified a targeted email attack against human rights and political activists that distributed a custom Android Trojan app with information-stealing capabilities.

The attack was launched several days ago from the compromised email account of a high-profile Tibetan activist and is the first documented case of Android malware being used in such a targeted attack, the Kaspersky Lab researchers said Tuesday in a blog post.

Last year, researchers from antivirus vendor Trend Micro identified two Android backdoor apps associated with the Luckycat advanced persistent threat cyberespionage campaign that were in early development, but there was no evidence that they had actually been used, said Denis Maslennikov, a senior malware analyst at Kaspersky Lab. However, in this new case, there's real evidence of an Android Trojan app being used in a targeted attack, he said.

The hackers used the compromised email account to send a specially crafted email message with an .apk (Android application package) attachment to everyone in the victim's contact list, which most likely included many other activists.

The rogue message used a recent conference about human rights issues in China organized by the World Uyghur Congress (WUC) as lure. The conference was held earlier this month in Geneva and brought together Uyghur, Tibetan, Mongolian and Chinese human rights activists.

The same event was used as bait in a different email attack targeting multiple activist groups earlier this month. However, that attack targeted Windows users and distributed a malicious Excel file.

The new emails detected during the past several days claimed that the attached "WUC's Conference.apk" file contained a letter from the conference organizers. The attackers most likely counted on the fact that a lot of people read their email on their Android smart phones and are likely to click on the .apk file and install it, Maslennikov said.

The .apk file installs a Trojan app called "Conference" that displays a message about the conference attributed to Dolkun lsa, the chairman of the executive committee of the World Uyghur Congress. This is only used as a distraction, because in the background, the app reports the successful infection to a command-and-control server hosted in the U.S. and waits for SMS commands to start uploading data like contact details, call logs, text messages, geo-location and phone identification information.

Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.

Tibetan and Uyghur activists have previously been targeted in APT-style attacks that infected their computers with Windows or Mac remote access tools (RATs). However, this new attack might be the first in a future wave of targeted attacks against Android users, the Kaspersky researchers said.

While this particular operation used social engineering to distribute the Android malware, the researchers expect attackers to start using exploits for zero-day vulnerabilities or other techniques to infect Android devices in the future. "We are almost 100 percent sure that we'll see attacks using exploits to infect Android devices without any kind of user interaction in 2013, and not only targeted attacks, but also attacks launched by traditional cybercriminals," Maslennikov said.


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

Apple's 2014 highlights: the most significant Apple news of 2014

IDG UK Sites

See the festive spots creative companies have released for Christmas

IDG UK Sites

Ultimate iOS 8 Tips: 35 awesome and advanced tips for using iOS 8 on iPhone and iPad