Android spyware is targeting Russian soldiers in Ukraine
A new spyware for Android smartphones has apparently targeted Russian military members. So far, hardly anything is known about the origin of the Schadcode – but it is likely that the Ukraine has its fingers in the game.
Hidden in card application
The malware with the name Android.Spy.1292.Origin is hidden in a manipulated version of the popular card application Alpine Quest, which is used in particular by hunters, athletes and Russian soldiers in Ukraine. The trojanized app is distributed via a special telegram channel and in unofficial Android app stores.
The application is offered as a free version of Alpine Quest, which is actually paid by the paid Pro variant – an incentive for many users to install them despite their dubious origin. Since the app can hardly be distinguished from the original, the malware often remains undetected, the Russian security company Dr.Web explained that the malware discovered.
When starting the infected application, the malware transmits a variety of sensitive data to a command-and-control server. These include the user’s telephone number, contacts from the address book, current location data, stored files and the app version. The attackers are particularly interested in confidential documents that are sent via Telegram or WhatsApp, as well as the location protocol “Loclog”, which Alpine Quest created.
Modular design
With its modular design, the malware can be subsequently expanded – for example, by new functions for data theft or spy. Meanwhile, Google announced that Android users should be protected against known versions of the malware with activated “Play Protect” protection mechanism. Nevertheless, the risk for users who install apps from uncertain sources remains high.
In parallel to the discovery of Android.spy.1292.Origin, the Moscow IT security company Kaspersky reported another threat: a previously unknown malware targeted Russian government, financial and industrial facilities. The attacks are made via manipulated update packages for the Vipnet security network – further evidence of the increasing complexity of digital warfare.
