Cybersecurity researchers have uncovered a new piece of mobile surveillance malware believed to be developed by a Russian defense contractor that has been sanctioned for interfering with the 2016 U.S. presidential election.
Dubbed Monokle, the mobile remote-access trojan has been actively targeting Android phones since at least March 2016 and is primarily being used in highly targeted attacks on a limited number of people.
According to security researchers at Lookout, Monokle possesses a wide range of spying functionalities and uses advanced data exfiltration techniques, even without requiring root access to a targeted device.
How Bad is Monokle Surveillance Malware
In particular, the malware abuses Android accessibility services to exfiltrate data from a large number of popular third-party applications, including Google Docs, Facebook messenger, Whatsapp, WeChat, and Snapchat, by reading text displayed on a device's screen at any point in time.
The malware also extracts user-defined predictive-text dictionaries to "get a sense of the topics of interest to a target," and also attempts to record the phone screen during a screen unlock event in order to compromise the phone's PIN, pattern or password.
Besides this, if the root access is available, the spyware installs attacker-specified root CA certificates to the list of trusted certificates on a compromised device, potentially enabling the attackers to easily intercept encrypted SSL-protected network traffic through Man-in-the-Middle (MiTM) attacks.
Other functionalities of Monokle includes:
- Track device location
- Record audio and calls
- Make screen recordings
- Keylogger and device-fingerprinting
- Retrieve browsing and call histories
- Take photos, videos, and screenshots
- Retrieve emails, SMSes, and Messages
- Steal contacts and calendar information
- making calls and sending text messages on behalf of victims
- Execute arbitrary shell commands, as root, if root access is available
In total, Monokle contains 78 different predefined commands, which attackers can send through SMS, phone calls, email message exchange through POP3 and SMTP, and inbound/outbound TCP connections, instructing the malware to exfiltrate requested data and send it to the attackers remote command-and-control servers.
Spyware Disguises as PornHub and Google Android Apps
According to the researchers, attackers are distributing Monokle through fake apps that look just like Evernote, Google Play, Pornhub, Signal, UC Browser, Skype, and other popular Android apps.
Moreover, some recent samples of Monokle even come bundled with Xposed modules that allow the malware to customize some system features, eventually extending its ability to hook and hide presence in the process list.
The malware package uses a DEX file in its assets folder that "includes all cryptographic functions implemented in the open source library "spongycastle," various email protocols, extraction and exfiltration of all data, serialization and deserialization of data using the Thrift protocol, and rooting and hooking functionality, among others."
The new Android malware and its capabilities remind us of the powerful surveillance malware Pegasus, developed by Israel-based NSO Group for both Apple iOS and Google Android devices.
However, unlike Russian spyware Monokle, Pegasus comes with powerful zero-day exploits that install the spyware on a targeted device with little to no user interaction.
Pegasus has previously been used to target human rights activists and journalists, from Mexico to the United Arab Emirates and again last year against an Amnesty International staffer in Saudi Arabia.
Comments
Post a Comment