Hackers linked to Syrian government target civilians with spyware via mobile apps  

Researchers have unearthed a COVID-19 related spyware campaign that is specifically targeting Syrians and “likely other Arabic speaking” individuals in the Middle East region. Threat researchers at mobile security specialists, Lookout, discovered that over the

past month, hackers, who are supposedly linked with the Syrian regime of President Bashar Al-Assad, have used at last 71 new malicious apps on Android mobile devices through the means of luring users with the coronavirus pandemic. The spyware threat is believed to retrieve critical intelligence on civilian movement, locations, messages, pictures, videos, audios and contacts.

The full research can be found here: https://blog.lookout.com/nation-state-mobile-malware-targets-syrians-with-covid-19-lures

Kristen Del Rosso, senior security intelligence engineer at Lookout said regarding attribution to the campaign:

We believe there is a high probability this campaign can be attributed to the Syrian Electronic Army. They are a known pro-Assad group and the Syrian government has tight control over internet infrastructure and a heavy history of digital censorship. The malicious apps reported on in this blog contained unintentional traces of a persona (“Allosh”) previously associated with this group in the “SilverHawk” campaign. She continues, “in addition, this campaign’s infrastructure is located in a block of addresses held by Tarassul Internet Service Provider, an ISP owned by — and sharing network infrastructure with — the state-owned Syrian Telecommunications Establishment (STE). The Android malware previously associated with this group, SilverHawk, was also located on IP addresses belonging to STE.

None of these corrupted apps were available on the official Google Play Store, suggesting they were likely distributed through actor-operated watering holes or third-party app stores.

Of the malicious applications in this campaign, 64 of 71 are SpyNote samples, a well known commercial surveillanceware family. The remainder belong to the SandroRat, AndoServer, and SLRat families, of which the latter two have not yet been publicly reported on.

Lookout previously reported on another surveillanceware campaign using COVID-19 related lures targeting Libya.

The newly installed application (com.finger.body.temperature.ap) is a benign prank – a fake digital thermometer that serves as a decoy. Meanwhile the malware continues to operate in the background.