Arid Viper’s AridSpy Trojan Hits Android Customers in Palestine, Egypt

Cybersecurity researchers at ESET have uncovered a brand new Android cell malware marketing campaign by the Arid Viper APT group. This marketing campaign targets Android customers in Egypt and Palestine with trojanized apps distributing espionage-focused, remotely managed AridSpy trojan.

To your info, Arid Viper, also called APT-C-23, Desert Falcons, or Two-tailed Scorpion, is a cyberespionage group lively since 2013. They aim Center Japanese nations and have an enormous malware arsenal for Android, iOS, and Home windows platforms. In February 2013, the group was discovered concentrating on Israelis with malware embedded in an X-rated video. In December 2020, the group returned with a brand new malware referred to as PyMICROPSIA malware however its goal remained the identical: Israelis.

As for the most recent marketing campaign, ESET’s Lukas Stefanko defined that round 5 espionage campaigns have been found to this point, three of that are nonetheless lively. These campaigns distribute malicious apps impersonating messaging, job alternatives, and Palestinian Civil Registry apps, together with NortirChat, LapizaChat, ReblyChat, تطبيق المشغل (Arabic job alternative app), and السجل المدني الفلسطيني (Palestinian Civil Registry) to distribute AridSpy trojan. 

These malicious apps are delivered by way of devoted third-party web sites, found utilizing telemetry, VirusTotal, and the FOFA community search engine and never by Google. Victims should allow the non-default Android possibility to put in them.

Six cases of AridSpy have been detected in ESET’s telemetry originating from Palestine and Egypt, most registered for the malicious Palestinian Civil Registry app. In Egypt, the identical first-stage payload was discovered with a special package deal identify, and one other first-stage payload was detected utilizing the identical C&C servers as samples in LapizaChat and job alternative campaigns.

ESET suspects AridSpy trojan for this marketing campaign as a result of the group focuses on concentrating on organizations in Palestine and Egypt, and a malicious JavaScript file “myScript.js,” which was beforehand linked to Arid Viper by 360 Beacon Labs and FOFA, was detected on this occasion as nicely. 360 Beacon Labs reported that the identical JavaScript code was utilized in a marketing campaign concentrating on the FIFA World Cup in Qatar with an earlier model of AridSpy in 2022.

AridSpy trojan is a harmful malware that may keylog seen and editable textual content in functions, particularly concentrating on Fb Messenger and WhatsApp communications. It makes use of built-in accessibility providers to file seen textual content and add it to a C&C server, exposing customers to dangers like identification theft, monetary fraud, and blackmail.

Due to this fact, apply warning when downloading apps from untrusted sources and follow official app shops like Google Play Retailer to remain protected. At all times learn app opinions and rankings and examine app permissions to make sure a safe looking expertise.

1. Hackers Goal Israeli Rocket Alert App Customers with Spy ware
2. Professional-Palestinian TA402 APT Utilizing IronWind Malware in New Assault
3. Android malware on Play Retailer concentrating on Palestinians on Fb
4. IsraBye Anti-Israeli wiper malware locks information that may’t be restored
5. Hamas-Linked Group Revives SysJoker Malware, Leverages OneDrive