Android Spyware Created by Russian Defense Contractor

cybersecurity researchers have uncovered a new piece of mobile surveillance malware believed to be developed by a Russian defense contractor that has been sanctioned for interfering with the 2016 U.S. presidential election.

Dubbed Monokle, the mobile remote-access trojan has been actively targeting Android phones since at least March 2016 and is primarily being used in highly targeted attacks on a limited number of people.

According to security researchers at Lookout, Monokle possesses a wide range of spying functionalities and uses advanced data exfiltration techniques, even without requiring root access to a targeted device.

How Bad is Monokle Surveillance Malware

In particular, the malware abuses Android accessibility services to exfiltrate data from a large number of popular third-party applications, including Google Docs, Facebook messenger, Whatsapp, WeChat, and Snapchat, by reading text displayed on a device's screen at any point in time.

The malware also extracts user-defined predictive-text dictionaries to "get a sense of the topics of interest to a target," and also attempts to record the phone screen during a screen unlock event in order to compromise the phone's PIN, pattern or password.

Besides this, if the root access is available, the spyware installs attacker-specified root CA certificates to the list of trusted certificates on a compromised device, potentially enabling the attackers to easily intercept encrypted SSL-protected network traffic through Man-in-the-Middle (MiTM) attacks.

Other functionalities of Monokle includes:

Track device locationRecord audio and callsMake screen recordingsKeylogger and device-fingerprintingRetrieve browsing and call historiesTake photos, videos, and screenshotsRetrieve emails, SMSes, and MessagesSteal contacts and calendar informationmaking calls and sending text messages on behalf of victimsExecute arbitrary shell commands, as root, if root access is available In total, Monokle contains 78 different predefined commands, which attackers can send through SMS, phone calls, email message exchange through POP3 and SMTP, and inbound/outbound TCP connections, instructing the malware to exfiltrate requested data and send it to the attackers remote command-and-control servers.

Spyware Disguises as PornHub and Google Android Apps

According to the researchers, attackers are distributing Monokle through fake apps that look just like Evernote, Google Play, Pornhub, Signal, UC Browser, Skype, and other popular Android apps.

Most of these apps even include legitimate functionality, preventing targeted users from suspecting the apps are malicious.

Moreover, some recent samples of Monokle even come bundled with Xposed modules that allow the malware to customize some system features, eventually extending its ability to hook and hide presence in the process list.

The malware package uses a DEX file in its assets folder that "includes all cryptographic functions implemented in the open source library "spongycastle," various email protocols, extraction and exfiltration of all data, serialization and deserialization of data using the Thrift protocol, and rooting and hooking functionality, among others."

Russian Defense Contractor STC Developed Monokle Malware

Monokle was developed by a Russia-based company, called Special Technology Centre Ltd. (STC)—a private defense contractor known for producing UAVs and Radio Frequency (RF) equipment for Russian military as well as other government customers.

According to Lookout researchers, Monokle and STC's Android security suite called Defender are digitally signed with the same cryptographic certificates and also share the same command and control infrastructure.

Monokle for iOS Under Development

Besides Android, researchers also came across some Monokle malware samples, analysis of which revealed the existence of iOS versions of Monokle targeting Apple devices, though the researchers found no evidence of any active iOS infection as of now. Some commands in the malware samples appear to serve no purpose as part of the Android client and have likely been added unintentionally, which suggests that the iOS versions of Monokle may be under development.

Those commands include iOS functions for the keychain, iCloud connections, Apple iWatch accelerometer data, iOS permissions, and other iOS features or services.

According to Lookout researchers, Monokle is used in highly targeted attacks on a limited number of people in the Caucasus regions of Eastern Europe as well as individuals interested in Islam and the Ahrar al-Sham militant group in Syria, and individuals in the Central Asian nation and former Soviet republic Uzbekistan.

For more depth analysis visit SOURCE : 1 2

An Ethical hacker should know the penalties of unauthorized hacking into a system. Read more at: Legality and Ethics

#security #cybersecurity #whizsecurity #infosecurity #itsecurity #hacking #whizsec #spyware #malware #android #androidspyware #viceleaker #middleeast #kaspersky #trojanapps #trojan #smali #baksmali #androidmalware #home #news #iphone #iphonespyware #exodus #apple #ios #androidphones #exodusspyware #Android #Android90


For more tricks and update over hacking stay tuned to our site: Note 4 Tech