@BushidoToken Threat Intel

Introduction Russian state-sponsored threat groups, such as Fancy Bear (APT28), Cozy Bear (APT29), Turla, and Sandworm, among others, are well-known for complex cyber-espionage operations, targeted intrusions, destructive attacks, and disinformation campaigns. Some of the capabilities of Russian threat groups, however, are not well-known and extend beyond the usual targeting of government and critical infrastructure enterprise networks. The main three Russian intelligence services (GRU, FSB, and SVR) have also conducted less well-known and underreported intelligence gathering campaigns against Android and iPhone users delivering spyware as well as collecting credentials for specific mobile applications. In this blog, I will be examining open source intelligence (OSINT) reports, leveraging the findings and citing investigations conducted by other threat researchers, to present my key findings and an overall assessment of these mobile threat campaigns. Background on Mobile Threat...

As the COVID-19 lockdown continues, there has been an increasing number of mobile threats appearing on the threat landscape. Android devices are by far the main targets of threat actors which have been delivering fake apps in the form of malicious .APK files to install banking Trojans, like Cerberus , as well as a number of spyware and SMS worms. ESET's malware expert, Lukas Stefanko, along with Malware Hunter Team, have uncovered and analysed an interesting new open-source Android Trojan called XploitSPY.  XploitSPY - new open-source Android Spying Tool -already spreads on UND forums -developed by cyber security solutions company from #India 🇮🇳 (3 ethical hackers) -they have 25years of exper. but based on photo they are under 30 -they also open-sourced Instagram phishing solution https://t.co/SEILSe5KAO pic.twitter.com/q8rIcE1pvI — Lukas Stefanko (@LukasStefanko) April 13, 2020 According to the researchers the malware has been designed by three ethical...