Chinese Hackers

[kyonides]

Chinese APT41 Group Attack Android Devices
With WyrmSpy and DragonEgg Malware

A Chinese-based state-sponsored espionage group, APT41 targets Android devices through spyware wyrmspy and Dragon egg which masquerades as legit applications.

This group has been active since 2012 and targets both public and private sectors related to software development, hardware manufacturers, telecommunications, social media, video games, etc.

According to U.S. grand jury indictments from 2019 and 2020, the group was involved in compromising over 100 public and private organizations and individuals in the United States and around the world.
...
Initially, this malware imitates legitimate Android applications for showing notifications; once successfully installed on the user’s machine, it claims multiple device permission to enable data exfiltration.

Google confirmed that based on current detection, no apps containing this malware are found to be on Google Play.

Wyrmspy can collect log files, photos, Device location, SMS messages (read and write), and Audio recordings.

Utilizes known rooting tools to gain escalated privileges to the device and perform surveillance activities specified by commands received from its C2 servers.
...
This file tries to get and launch more functionality like WyrmSpy; the DragonEgg samples ask for many permissions for services that aren’t actually used in the main app.

Dragon Egg is also able to collect data like Device contacts, SMS messages, External device storage files, Device location, Audio recording, and Camera photos once it successfully compromises the device.