A previously unknown Android malware uses the same shared-hosting infrastructure previously seen used by the Russian APT group known as Turla, though attribution to the hacking group is not possible.
Turla is a Russian state-supported hacking group known for using custom malware to target European and American systems, primarily for espionage. The threat actors have recently been linked to the Sunburst backdoor used in the SolarWinds supply-chain attack in December 2020. Researchers from Lab52 identified a malicious APK [VirusTotal] named “Process Manager” that acts as Android spyware, uploading information to the threat actors.
While it is not clear how the spyware is distributed, once installed, however, the app disguises itself with a gear-shaped icon to look like a system component. Coupled with the ‘Process Manager’ name, it could be easily mistaken for part of the Android system. Upon its first launch, the app prompts the user to allow it to use 18 permissions.
These permissions are a serious risk to privacy as it allows the app to get a device’s location, send and read texts, access storage, take pictures with the camera, and record audio. It is unclear if the malware abuses the Android Accessibility service to grant itself permissions or if it’s tricking the user into approving a request. After receiving the permissions, the spyware removes its icon and runs in the background with only a permanent notification indicating its presence.
This aspect is quite strange for spyware that should usually strive to remain hidden from the victim, especially if this is the work of a sophisticated APT (advanced persistent threat) group.
The information collected by the device, including lists, logs, SMS, recordings, and event notifications, are sent in JSON format to the command and control server at 82.146.35[.]240, which is located in Russia. The method of distribution for the APK is unknown, but if it is Turla, they commonly use social engineering, phishing, watering hole attacks, etc., so it could be anything.
While researching the app, the Lab52 team also found that it downloads additional payloads to the device and found a case of an app fetched directly from the Play Store. The app is named “Roz Dhan: Earn Wallet cash,” and it’s a popular (10,000,000 downloads) app featuring a money-generating referral system. The spyware reportedly downloads the APK via the app’s referral system, likely to earn a commission, which is somewhat strange given that the particular actor is focused on cyber espionage.
This, in addition to the seemingly unsophisticated implementation of the Android spyware, leads us to believe that the C2 analyzed by Lab52 may be part of a shared infrastructure. State actors are known for following this tactic, even if rarely, as it helps them obscure their trace and confuse analysts.
However, due to the low sophistication of the malware’s threat capabilities and the use of referral-based monetization, the researchers do not believe this to be the work of a nation-state actor, like Turla.
Users of Android devices are advised to review the app permissions they have granted, which should be fairly easy on versions from Android 10 and later, and revoke those that appear overly risky.
Also, starting from Android 12, the OS pushes indications when the camera or microphone is active, so if these appear orphaned, spyware is hiding in your device.
These tools are particularly dangerous when nesting inside IoTs that run older Android versions, generating money for their remote operators for prolonged periods without anyone realizing the compromise.