In March 2024, Kaspersky researchers discovered a campaign targeting individuals in Russia with previously unseen Android spyware they dubbed LianSpy. Kaspersky analysis indicates that the malware has been active since July 2021.
This threat is equipped to capture screencasts, exfiltrate user files, and harvest call logs and app lists. The malicious actor behind LianSpy employs multiple evasive tactics, such as leveraging a Russian cloud service, Yandex Disk, for C2 communications. They also avoid having dedicated infrastructure, and employ a lot of other features to keep the spyware undiscovered. Some of these features suggest that LianSpy is most likely deployed through either an unknown vulnerability or direct physical access to the target phone.
Read more…
Source: Kaspersky
Related:
- New hacking group ‘Metador’ lurking in ISP networks for months
September 25, 2022
A previously unknown threat actor that researchers have named ‘Metador’ has been breaching telecommunications, internet services providers (ISPs), and universities for about two years. Metador targets organizations in the Middle East and Africa and their purpose appears to be long-term persistence for espionage. The group uses two Windows-based malware that have been described as “extremely complex” ...
- Webworm: Espionage Attackers Testing and Using Older Modified RATs
September 15, 2022
Symantec, by Broadcom Software, has gained insight into the current activities of a group we call Webworm. The group has developed customized versions of three older remote access Trojans (RATs), including Trochilus, Gh0st RAT, and 9002 RAT. At least one of the indicators of compromise (IOCs) observed by Symantec was used in an attack against ...
- New Wave of Espionage Activity Targets Asian Governments
September 13, 2022
A distinct group of espionage attackers who were formerly associated with the ShadowPad remote access Trojan (RAT) has adopted a new, diverse toolset to mount an ongoing campaign against a range of government and state-owned organizations in a number of Asian countries. The attacks, which have been underway since at least early 2021, appear to ...
- Boffins build microphone safety kit to detect eavesdroppers
September 12, 2022
Scientists from the National University of Singapore and Yonsei University in the Republic of Korea have developed a device for verifying whether your laptop microphone is secretly recording your conversations. The researchers – Soundarya Ramesh, Ghozali Suhariyanto Hadi, Sihun Yang, Mun Choon Chan, and Jun Han – call the device TickTock. That may suit a lab ...
- Greece wiretap and spyware claims circle around PM Mitsotakis
September 8, 2022
It has been dubbed the Greek Watergate. What began as a surveillance of a little-known journalist in Greece has evolved into an array of revelations circling around the Greek government. The story emerged last spring, when Thanasis Koukakis found out his phone had been infected with spyware that can extract data from a device. He also ...
- China strongly condemns US cyber attacks on China’s Northwestern Polytechnical University
September 6, 2022
China strongly condemns the cyber attacks launched by the United States on China’s Northwestern Polytechnical University, and urges the U.S. side to offer an explanation and immediately stop its unlawful moves, Foreign ministry spokesperson Mao Ning said Monday. It was reported that China’s National Computer Virus Emergency Response Center (CVERC) and cybersecurity company 360 on Monday ...