Cyber Espionage: The Rise of Chinese Android Spyware

A China-Based APT Group Distributes Android Spyware via Trojanized Messaging Apps

Overview

A China-based advanced persistent threat (APT) group known as GREF has been distributing Android spyware to users in several countries through Trojanized versions of the popular messaging apps Signal and Telegram. The malicious apps, named Signal Plus Messenger and FlyGram, claim to offer additional features and modifications not available in the official versions. However, they also secretly exfiltrate device and user information and allow the threat actor to spy on communications. The campaign has attracted thousands of downloads from reputable app stores and websites set up by the threat actor.

Scope

Researchers from cybersecurity firm ESET, who discovered the campaign, have identified infected devices in 16 countries, including the United States, Australia, Germany, Brazil, and Singapore. The main goal of the threat actor appears to be user espionage, with a particular focus on Signal communication, especially with the malicious Signal Plus Messenger app. The researchers have been monitoring the activities of GREF and have found no evidence of specific targeting of individuals or groups, unlike their previous use of the BadBazaar malware. The researchers believe that GREF uploaded Signal Plus Messenger to Google Play in July 2022 and FlyGram in early June 2020.

Malware Functionality

Both Signal Plus Messenger and FlyGram belong to the BadBazaar malware family, which has been attributed to the China-based APT15 group by other vendors. FlyGram can extract basic device information, contact lists, call logs, Google account details, and metadata from Telegram apps, including the user’s full backup if they enable a specific Cloud Sync feature. Telemetry data showed that at least 13,953 individuals who downloaded FlyGram had activated this malicious feature. Signal Plus Messenger collects similar device and user information but focuses on spying on the user’s Signal communications. The malware is unique in its ability to extract the user’s Signal PIN and use it to link their Signal Desktop and Signal iPad to the threat actor’s phone. This approach stands out due to its uniqueness compared to other known malware.

Impact and Attribution

The distribution of this Android spyware poses a potentially significant threat to victims. FlyGram can not only spy on users but also download additional custom payloads and force users to install them. On the other hand, malicious Signal Plus Messenger enables active espionage on exchanged Signal communication. For specific individuals and enterprises, the impact of these attacks can be substantial. ESET researcher Lukáš Štefanko notes that while several other vendors have linked BadBazaar to APT15, ESET does not have enough conclusive evidence to establish that connection. However, telemetry data related to the malware, Trojanized apps, and the threat infrastructure all point to GREF as the possible operator of BadBazaar.

Editorial: The Threat of State-Sponsored Cyber Espionage

The Irreparable Damage of Espionage

The recent distribution of Android spyware by a China-based APT group highlights the growing threat of state-sponsored cyber espionage. Campaigns like the one carried out by GREF not only compromise individual privacy but also have broader implications for national security, business operations, and personal freedoms. Once personal data, communications, and intellectual property fall into the wrong hands, their impact can be irreparable.

Countries Must Strengthen Cybersecurity

Governments and organizations around the world must recognize the significance of state-sponsored cyber espionage and take proactive measures to strengthen their cybersecurity defenses. This includes investing in robust threat monitoring and detection systems, implementing strict access controls and data encryption, and educating employees and users about the risks of downloading apps from unofficial sources.

Collaboration and International Cooperation

Addressing the threat of state-sponsored cyber espionage requires cooperation among nations. Governments should work together to share intelligence, identify the actors behind these attacks, and hold them accountable. International frameworks and agreements should be established to guide collective responses and enforce consequences for those who engage in such malicious activities.

Advice for Users and Organizations

Download Apps from Official Sources

To minimize the risk of downloading malicious apps, users should only download applications from official and reputable sources, such as Google Play and Apple’s App Store. These platforms have rigorous security checks in place to ensure that apps meet certain standards and are less likely to contain malware.

Be Cautious of Unofficial App Stores and Websites

Avoid downloading apps from unofficial app stores or websites, as they may host Trojanized or malicious versions of popular apps. Stick to well-known platforms that have established security measures in place.

Regularly Update Apps

Keep all your apps, including messaging apps, up to date with the latest versions. Developers often release updates that address security vulnerabilities and improve overall app security.

Exercise Caution with App Permissions

When installing an app, carefully review the permissions it requests. Avoid granting excessive permissions that the app does not need to function properly. Limiting app permissions can help protect your privacy and minimize the risk of data exfiltration.

Use Security Software

Install reputable security software on your mobile devices to detect and block potential threats. Regularly update the security software to ensure it has the latest threat intelligence.

Encrypt Sensitive Communications

For added security, consider using end-to-end encrypted messaging apps like Signal, which provide strong encryption for your communications. Be cautious of unofficial versions of these apps and only download them from official sources.

Implement Strong Cybersecurity Measures

Organizations should implement robust cybersecurity measures, including network monitoring, regular security assessments, employee training, and incident response plans. These measures can help mitigate the risk of cyberattacks and minimize potential damage.

Conclusion

The distribution of Android spyware through Trojanized messaging apps serves as a stark reminder of the increasing sophistication of state-sponsored cyber espionage. Individuals, organizations, and governments must stay vigilant, collaborate internationally, and take proactive steps to enhance cybersecurity defenses and protect against these evolving threats.