In March 2024, Kaspersky researchers discovered a campaign targeting individuals in Russia with previously unseen Android spyware they dubbed LianSpy. Kaspersky analysis indicates that the malware has been active since July 2021.
This threat is equipped to capture screencasts, exfiltrate user files, and harvest call logs and app lists. The malicious actor behind LianSpy employs multiple evasive tactics, such as leveraging a Russian cloud service, Yandex Disk, for C2 communications. They also avoid having dedicated infrastructure, and employ a lot of other features to keep the spyware undiscovered. Some of these features suggest that LianSpy is most likely deployed through either an unknown vulnerability or direct physical access to the target phone.
Read more…
Source: Kaspersky
Related:
- Apple iPhone Malware Tactic Causes Fake Shutdowns to Enable Spying
January 6, 2022
In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real power-off while allowing malware to remain ...
- After NSO Scandal, What’s Next for Israel’s Cyber Industry?
December 28, 2021
The year 2021 was not a good one for NSO Group, an Israeli technology firm that became famous, and then notorious, for its Pegasus spyware, capable of remote surveillance of smartphones. Once a promising startup that developed a unique tool to fight against terror and crime, NSO Group is now associated with targeted attacks against journalists ...
- Meta bans ‘cyber-mercenaries’ that targeted 50,000 people
December 17, 2021
Meta, Facebook’s parent company, has banned several “cyber-mercenary” groups thought to have been offering surveillance services aimed at activists, dissidents and journalists worldwide. The social media giant said on Thursday it had begun warning about 50,000 people it believed may have come under scrutiny across more than 100 nations. The Facebook parent said it deleted accounts tied ...
- A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
December 16, 2021
Google Project Zero researchers want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with them, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with Google Project Zero on the technical analysis. The editorial opinions reflected below are solely Project Zero’s and do not necessarily reflect those of the organizations ...
- PseudoManuscrypt: a mass-scale spyware attack campaign
December 16, 2021
In June 2021, Kaspersky ICS CERT experts identified malware whose loader has some similarities to the Manuscrypt malware, which is part of the Lazarus APT group’s arsenal. In 2020, the group used Manuscrypt in attacks on defense enterprises in different countries. These attacks are described in the report “Lazarus targets defense industry with ThreatNeedle“. Curiously, the ...
- US lawmakers want to put NSO Group, 3 other spyware makers out of business with fresh severe sanctions
December 15, 2021
Eighteen US Democratic lawmakers have asked the Treasury Department and State Department to punish Israel-based spyware maker NSO Group and three other surveillance software firms for enabling human rights abuses. In a letter signed by US Senator Ron Wyden (D-OR), House Intelligence Committee Chairman Adam Schiff (D-CA), and 16 others, the legislators urge Secretary of ...