Loading malware…
RCSAndroid, short for Remote Control System Android, is a sophisticated Android surveillance implant associated with Hacking Team and documented in targeted operations since at least 2012. It is best characterized as mobile spyware designed for covert collection of communications, credentials, device data, and sensor-derived intelligence from compromised handsets. Public reporting linked its use to attacks against Android users in Saudi Arabia, and later exposure of its source code increased concern that its capabilities could be repurposed beyond its original operator set.
RCSAndroid is a modular framework that combines delivery components, browser exploitation, an APK-based installer, low-level collection code, and command-and-control functionality. Reported infection vectors included SMS-based lures directing targets to exploit-hosting websites and a trojanized news application distributed through Google Play. The exploit-based delivery chain abused vulnerabilities in default Android browsers on older Android versions, specifically CVE-2012-2825 and CVE-2012-2871, enabling compromise of Android 4.0 through 4.3 devices.
Once installed, RCSAndroid supports broad surveillance and data-theft functions. Reported capabilities include recording audio through the microphone, capturing photos with front and rear cameras, collecting SMS, MMS, and Gmail messages, harvesting Wi-Fi and online account passwords, gathering contacts, monitoring clipboard contents, capturing screenshots, tracking device location, and extracting or decoding communications from multiple messaging applications. It has also been reported to intercept voice communications in real time by hooking Android media services, reflecting a high level of engineering maturity for mobile espionage malware.
The malware targets Android devices and aligns with intrusive post-compromise espionage activity rather than financially motivated commodity abuse. Its breadth of collection, stealth-oriented design, and persistence characteristics place it among the more capable historical Android spyware families. Removal may be difficult in some cases, with reporting indicating that full remediation could require reflashing device firmware.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
RCSAndroid has been actively used since 2012 and has been known to researchers since 2014, when research group Citizen Lab detailed a Hacking Team backdoor used against Android users in Saudi Arabia.
13 distinct techniques documented for this family, organized by ATT&CK tactic.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
The malicious sites, in turn, exploited known exploits, designated as CVE-2012-2825 and CVE-2012-2871, and are present in the default browsers found in Android versions from 4.0 to 4.3.
The first involved text messages that lured users to booby-trapped websites.
A second infection method was to use a fake news app called "BeNews," which as Ars reported earlier this week was available on the official Google Play Android market.
A second infection method was to use a fake news app called "BeNews," which as Ars reported earlier this week was available on the official Google Play Android market.
Gooligan steals authentication tokens that can be used to access data from multiple Google applications. RCSAndroid can collect passwords for Wi-Fi networks and online accounts, including Skype, Facebook, Twitter, Google, WhatsApp, Mail, and LinkedIn. Monokle can retrieve the salt used when storing the user’s password, aiding an adversary in computing the user’s plaintext password/PIN from the stored password hash.
Gather device information
Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.
RCSAndroid includes the ability to: Capture screenshots using the “screencap” command and framebuffer direct reading
RCSAndroid includes the ability to: Monitor clipboard content
Record using the microphone
Capture photos using the front and back cameras
The Android surveillance suite works like a “cluster bomb” that combines multiple attack tools... and a command-and-control server infrastructure infected devices can connect to.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.