Loading malware…
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this blog post, we describe Chrysaor, a newly discovered family of spyware that was used in a targeted attack on a small number of Android devices... Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Repeated commands: use alarms to periodically repeat actions on the device to expose data, including gathering location data.
To install Chrysaor, we believe an attacker coaxed specifically targeted individuals to download the malicious software onto their device.
Repeated commands: use alarms to periodically repeat actions on the device to expose data, including gathering location data.
Installing itself on the /system partition to persist across factory resets
Repeated commands: use alarms to periodically repeat actions on the device to expose data, including gathering location data.
Upon installation, the app uses known framaroot exploits to escalate privileges and break Android’s application sandbox.
Installing itself on the /system partition to persist across factory resets
If the targeted device is not vulnerable to these exploits, then the app attempts to use a superuser binary pre-positioned at /system/csk to elevate privileges.
Deleting WAP push messages and changing WAP message settings, possibly for anti-forensic purpose.
Finally, the app can remove itself through three ways: Via a command from the server ... Via an antidote file.
messages from selected messaging apps, including WhatsApp, Twitter, Facebook, Kakoa, Viber, and Skype by making /data/data directories of the apps world readable.
Keylogging: record input events by hooking IPCThreadState::Transact from /system/lib/libbinder.so
Data collectors are used in conjunction with repeated commands to collect user data including, SMS settings, SMS messages, Call logs, Browser History, Calendar, Contacts, Emails, and messages from selected messaging apps
Keylogging: record input events by hooking IPCThreadState::Transact from /system/lib/libbinder.so
Screenshots: captures an image of the current screen via the raw frame buffer.
RoomTap: silently answers a telephone call and stays connected in the background, allowing the caller to hear conversations within the range of the phone's microphone.
Messaging data exfiltration from common applications including WhatsApp, Skype, Facebook, Twitter, Viber, Kakao Browser history exfiltration Email exfiltration from Android’s Native Email client Contacts and text message
Starting content observers and the main task loop to receive remote commands and exfiltrate data.
The Android version performs similar spying functionality as Pegasus for iOS, including... Remote control of the malware via SMS
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.