Investigating China’s APT41: Unraveling the Connection to WyrmSpy and DragonEgg

Chinese State-Sponsored Threat Actor APT41 Develops Android Surveillanceware

An Overview of APT41 and Its Espionage Activities

Researchers have identified two Android surveillanceware programs, WyrmSpy and DragonEgg, and linked them to APT41, a Chinese state-sponsored threat actor known by aliases such as Winnti, BARIUM, and Double Dragon. This group has gained notoriety for its espionage campaigns targeting government agencies and enterprises, compromising organizations in the Asia-Pacific region, as well as countries like Australia, India, and the United States.

APT41‘s activities have led to the indictment of five of its members by the US Department of Justice. While the group primarily targets endpoint devices and internet-exposed web applications, it has also been found to engage in mobile attacks, delivering spyware disguised as Android applications.

The Connection Between WyrmSpy and DragonEgg

Lookout researchers have discovered that WyrmSpy and DragonEgg share overlapping Android code signing certificates, indicating that they were developed by the same group. Furthermore, the source code of early WyrmSpy samples contained a hardcoded command-and-control (C2) server address, which was linked to APT41 in the 2020 indictment by the US Department of Justice.

The Advanced Capabilities of APT41‘s Surveillanceware

APT41‘s surveillanceware sets itself apart from typical malware by exhibiting advanced characteristics. According to Kristina Balaam, a senior security intelligence engineer at Lookout, many malware authors are lazy and ask for excessive permissions without disguising their intentions. However, APT41 goes beyond that.

WyrmSpy, which has been active since at least 2017, often masquerades as a default Android system application or adopts various disguises, such as adult video content or popular apps like Baidu Waimai and Adobe Flash. Upon infecting a device, WyrmSpy escalates privileges by deploying rooting tools and executes commands received from the attacker-controlled C2 server. It can access log files, read a device’s location, exfiltrate audio files and photos, and read or write SMS messages.

Notably, APT41‘s surveillanceware is modular, allowing the attackers to continuously update and improve its functionality. This modularity is also observed in DragonEgg, which was first detected in 2021. Similar to WyrmSpy, DragonEgg infiltrates malicious apps, including third-party keyboards and a trojanized version of Telegram, and requests extensive permissions to steal a user’s contacts, SMS messages, external device storage files, location, photos, and audio recordings.

The Unknown Scope of Infostealing Activities

It remains unclear how many victims have fallen prey to WyrmSpy and DragonEgg. Balaam expresses the difficulty in tracking these infostealers, as they target a wide range of demographics through common applications like Adobe Flash and Telegram. While APT41 primarily focuses on governments and corporations, they have also employed similar Android malware to target specific communities, such as the Uyghurs.

Protecting Against APT41‘s Surveillanceware

Battling a formidable threat actor like APT41 may seem overwhelming for individuals, but there are steps that can be taken to enhance mobile security.

First and foremost, adhering to basic mobile security hygiene is crucial. Users should only download software from official app stores to mitigate the risk of downloading malicious apps. Additionally, antivirus software, even the most basic version, can provide an additional layer of protection. It can detect various forms of surveillanceware, adware, and banking Trojans, enabling users to receive alerts and remove such threats effectively.

Conclusion

The discovery of APT41‘s surveillanceware programs, WyrmSpy and DragonEgg, highlights the sophisticated tactics employed by Chinese state-sponsored threat actors. As the group extends its reach to mobile devices, individuals must remain vigilant about the apps they download and ensure they have adequate security measures in place to protect themselves from surveillance, data theft, and other potential threats.