Nov 15, 2021
85 Views
0 0

Fake end-to-end encrypted chat app distributes Android spyware

Written by

FBI system hacked to email ‘urgent’ warning about fake cyberattacks
New Windows 11 build fixes widespread printer issues, system freezes
QBot returns for a new wave of infections using Squirrelwaffle
Costco discloses data breach after finding credit card skimmer
US Education Dept urged to boost K-12 schools’ ransomware defenses
Master the cloud with this pre-Black Friday deal on AWS training
FBI system hacked to email ‘urgent’ warning about fake cyberattacks
Fake end-to-end encrypted chat app distributes Android spyware
Qualys BrowserCheck
STOPDecrypter
AuroraDecrypter
FilesLockerDecrypter
AdwCleaner
ComboFix
RKill
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Toksearches.xyz Search Redirect
Remove the Smashapps.net Search Redirect
Remove the Smashappsearch.com Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
eLearning
IT Certification Courses
Gear + Gadgets
Security
Spyware
The GravityRAT remote access trojan is being distributed in the wild again, this time under the guise of an end-to-end encrypted chat application called SoSafe Chat.
This particular RAT (remote access trojan) targets predominately Indian users, being distributed by Pakistani actors.
The telemetry data on the most recent campaign shows that the targeting scope hasn’t changed, and Gravity is still targeting high-profile individuals in India, like officers of the Armed Forces.
In 2020, the malware was targeting people via an Android app named ‘Travel Mate Pro,’ but since the pandemic has slowed down traveling, the actors moved to a new guise.
The app is now called ‘SoSafe Chat’ and is promoted as a secure messaging application that features end-to-end encryption.
The website that likely played a role in the distribution of the app (sosafe.co[.]in) remains online today, but the download link and the registration form are no longer working.
The channel and method of distribution remain unknown, but it was likely by driving traffic to the site through malvertising, social media posts, and instant messages to targets.
Once installed on a target’s device, the spyware can perform a wide range of malicious behavior, allowing the threat actors to exfiltrate data, spy on the victim, and track their location.
The complete list of malicious behavior includes
According to researchers at Cyble, the list of permissions that the malware requests for this functionality is naturally quite extensive, but it can still appear justified for an IM app.
Compared to the 2020 version, GravityRAT has added the ability to record audio and added mobile-specific features like location fetching and cellular network data exfiltration.
Before the 2020 version, GravityRAT would exclusively target Windows machines, not having the ability to infect mobile devices.
As such, the reemergence of the malware in the wild in targeting mobile devices indicates that its authors are actively developing it.
PhoneSpy: Android spyware campaign targeting South Korean users
Android spyware spreading as antivirus software in Japan
Android spyware apps target Israel in three-year-long campaign
Chinese hackers use Windows zero-day to attack defense, IT firms
Microsoft warns of surge in HTML smuggling phishing attacks
Not a member yet? Register Now
FBI system hacked to email ‘urgent’ warning about fake cyberattacks
Surveillance firm pays $1 million fine after ‘spy van’ scandal
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.

source

Article Categories:
Cybersecurity News

Comments are closed.