Security researchers from antivirus vendor Kaspersky Lab have identified a targeted email attack against human rights and political activists that distributed a custom Android Trojan app with information-stealing capabilities.
The attack was launched several days ago from the compromised email account of a high-profile Tibetan activist and is the first documented case of Android malware being used in such a targeted attack, the Kaspersky Lab researchers said Tuesday in a blog post.
Last year, researchers from antivirus vendor Trend Micro identified two Android backdoor apps associated with the Luckycat advanced persistent threat cyberespionage campaign that were in early development, but there was no evidence that they had actually been used, said Denis Maslennikov, a senior malware analyst at Kaspersky Lab. However, in this new case, there's real evidence of an Android Trojan app being used in a targeted attack, he said.
The hackers used the compromised email account to send a specially crafted email message with an .apk (Android application package) attachment to everyone in the victim's contact list, which most likely included many other activists.
The rogue message used a recent conference about human rights issues in China organized by the World Uyghur Congress (WUC) as lure. The conference was held earlier this month in Geneva and brought together Uyghur, Tibetan, Mongolian and Chinese human rights activists.
The same event was used as bait in a different email attack targeting multiple activist groups earlier this month. However, that attack targeted Windows users and distributed a malicious Excel file.
The new emails detected during the past several days claimed that the attached "WUC's Conference.apk" file contained a letter from the conference organizers. The attackers most likely counted on the fact that a lot of people read their email on their Android smart phones and are likely to click on the .apk file and install it, Maslennikov said.
The .apk file installs a Trojan app called "Conference" that displays a message about the conference attributed to Dolkun lsa, the chairman of the executive committee of the World Uyghur Congress. This is only used as a distraction, because in the background, the app reports the successful infection to a command-and-control server hosted in the U.S. and waits for SMS commands to start uploading data like contact details, call logs, text messages, geo-location and phone identification information.
Various pieces of evidence strongly suggest that the people behind this attack campaign are Chinese speakers, Maslennikov said. For example, the malware contains various functions written in Chinese, the Windows 2003 installation running on the control server is configured to use Chinese localization, and a Web page found on the server contains random Chinese text.
Tibetan and Uyghur activists have previously been targeted in APT-style attacks that infected their computers with Windows or Mac remote access tools (RATs). However, this new attack might be the first in a future wave of targeted attacks against Android users, the Kaspersky researchers said.
While this particular operation used social engineering to distribute the Android malware, the researchers expect attackers to start using exploits for zero-day vulnerabilities or other techniques to infect Android devices in the future. "We are almost 100 percent sure that we'll see attacks using exploits to infect Android devices without any kind of user interaction in 2013, and not only targeted attacks, but also attacks launched by traditional cybercriminals," Maslennikov said.