Kasablanka

Kasablanka is a threat actor associated in the provided reporting with the development and use of the Android malware LodaRAT, also referred to in ESET reporting as Android 888 RAT. ESET linked Android 888 RAT to a campaign by the Kasablanka Group and noted that the group referred to the malware as LodaRAT, while BladeHawk referred to the same Android RAT as Gaza007. The malware provides extensive Android surveillance capabilities, including file theft and deletion, screenshots, device location tracking, Facebook credential phishing, installed-app discovery, photo theft, camera capture, ambient audio and phone-call recording, call placement, SMS theft, contact theft, and SMS sending. Reported ATT&CK-mapped behaviors include masquerading as legitimate applications, persistence via broadcast receivers, suppressing the application icon, deleting device data, credential phishing, application and file discovery, collection of call logs, location, contacts, audio, camera images, SMS messages, local files, screenshots, use of uncommon ports for command and control, and SMS control. Cisco Talos separately stated there were no relevant overlaps between YoroTrooper and Kasablanka, describing Kasablanka as the group behind development of LodaRat4Android, and assessed that LodaRAT is used by multiple distinct campaigns, meaning Kasablanka is not the sole operator of LodaRAT.