Kaspersky detects new Android-focused spyware posing as part of a religious minority


In the third quarter of 2022, Kaspersky researchers uncovered a previously unknown Android espionage campaign dubbed SandStrike. 

This actor targets a Persian-speaking religious minority, Baháʼí, by distributing VPN apps containing highly sophisticated spyware. 

To lure victims into downloading the spyware implants, the group set up Facebook and Instagram accounts with over 1,000 followers and designed attractive religious-themed graphic materials, setting up an effective trap for adherents of this belief. In addition, most of these social media accounts contain a link to a Telegram channel created by the attacker. 

In this channel, the actor behind SandStrike distributed a seemingly harmless VPN application to access sites banned in certain regions, for example, religious-related materials. To make this application fully functional, adversaries also set up their own VPN infrastructure, which contains fully-functioning spyware with capabilities allowing threat actors to collect and steal sensitive data. 

Besides this, APT actors also continuously changed their tactics throughout the third quarter of 2022, sharpening their toolsets and developing new techniques. The most significant findings include the following:

The new sophisticated malware platform targeting telecoms companies, ISPs, and universities

Together with SentinelOne, Kaspersky researchers analyzed a never-seen-before sophisticated malware platform dubbed Metatron. Metatron primarily targets telecommunications, internet service providers, and Middle Eastern and African universities. Metatron is designed to bypass native security solutions while deploying malware platforms directly into memory.  

The upgrade of advanced and sophisticated tools

Kaspersky experts observed Lazarus use the DeathNote cluster against victims in South Korea. The actor possibly used a strategic web compromise, employing an infection chain similar to that which Kaspersky researchers have previously reported, attacking an endpoint security program. However, experts discovered that the malware and infection schemes have also been updated. The actor used malware that hadn’t been seen before, with minimal functionality to execute commands from the C2 server. Using this implanted backdoor, the operator lay hidden in the victim’s environment for a month and collected system information.

Cyber-espionage continues to be a prime aim of APT campaigns

In the third quarter of 2022, Kaspersky researchers detected numerous APT campaigns whose main target is governmental institutions. Our recent investigations show that from February onwards, HotCousin has attempted to compromise foreign affairs ministries in Europe, Asia, Africa, and South America this year.

To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:

  • Provide your SOC team access to the latest threat intelligence (TI). The Kaspersky Threat Intelligence Portal is a single access point for the company’s TI, providing cyberattack data and insights gathered by Kaspersky over the past 20 years. To help businesses enable effective defenses in these turbulent times, Kaspersky announced free access to independent, continuously updated, and globally sourced information on ongoing cyberattacks and threats. Request access online.
  • Upskill your cybersecurity team to enable them to tackle the latest targeted threats with Kaspersky online training developed by GReAT experts. 
  • Use enterprise-grade EDR solutions such as Kaspersky EDR Expert. It is essential to detect threats among a sea of scattered alerts thanks to the automatic merging of alerts into incidents and to analyze and respond to an incident effectively.  
  • In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as the Kaspersky Anti-Targeted Attack Platform.
  • As many targeted attacks start with social engineering techniques, such as phishing, introduce security awareness training and teach practical skills to your team – using tools such as the Kaspersky Automated Security Awareness Platform.

Read the full APT Q3 2022 trends report at Securelist.com.