MalwareUsed by 1 actor

Andr/Spy-BFI

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

C-23

These samples are detected by Sophos Intercept X for Mobile as Andr/Spy-BFI .

via web archiveweb.archive.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Persistence

1 technique

T1556.005Reversible EncryptionEvidence1

Once installed, the spyware sends unique, identifiable device parameters to its command-and-control server.

Stealth

2 techniques

T1036MasqueradingEvidence1

The spyware app initially disguises itself as something called “App Updates” ... with names that include App Updates, System Apps Updates, or Android Update Intelligence.

T1564.003Hidden WindowEvidence1

Once the target has granted all these permissions, the app disguises itself to evade any attempts at manual removal by the user. The spyware changes its icon (and name) to disguise itself using an icon of one of the four apps: Google Play, Youtube, Google, or Botim.

Defense Impairment

1 technique

T1556.005Reversible EncryptionEvidence1

Once installed, the spyware sends unique, identifiable device parameters to its command-and-control server.

Credential Access

3 techniques

T1056Input CaptureEvidence1

The first time the user opens the app, it requests that the user grant the app specific permissions ... But the apps also use a bit of social engineering to ask the user to grant advanced permissions: notification access, device administrator, and the ability to observe the user’s actions while interacting with apps.

T1556.005Reversible EncryptionEvidence1

Once installed, the spyware sends unique, identifiable device parameters to its command-and-control server.

T1649Steal or Forge Authentication CertificatesEvidence1

Many of the new variants were found to have been digitally signed by a certificate ... that Sophos has associated with malware for years.

Collection

6 techniques

T1005Data from Local SystemEvidence1

The app does the following things: Collects SMS, contacts, call logs Collects images and documents

T1056Input CaptureEvidence1

T1113Screen CaptureEvidence1

Taking screenshots and recording video of the screen

T1123Audio CaptureEvidence1

Recording audio, incoming and outgoing calls, including WhatsApp calls

T1125Video CaptureEvidence1

Taking pictures using the camera

T1560Archive Collected DataEvidence1

Internal logging shows the app writing out the contents of the contact list, call logs, and SMS messages to a Zip archive it later uploads to its C2

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence1

Each functionality of the spyware has a command associated with it. The commands are received via Firebase messaging, and the spyware performs the corresponding function as and when instructed.

T1105Ingress Tool TransferEvidence1

We also found that it tried to install its own version of Botim from the application’s assets.

T1568Dynamic ResolutionEvidence1

One of the newer features of this variant is that it will, initially, use a hardcoded C2 address to communicate, but also contains code that allows the operators of the spyware to push down a new address.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Internal logging shows the app writing out the contents of the contact list, call logs, and SMS messages to a Zip archive it later uploads to its C2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

web archiveNews

Nov 23, 2021

Android APT spyware, targeting Middle East victims, enhances evasiveness - Sophos News

Android spyware attributed to the C-23 threat actor. It masquerades as update-themed apps, requests extensive permissions, can change its icon/name to impersonate legitimate apps, receives commands via Firebase messaging, and steals SMS, contacts, call logs, images, documents, notifications, screenshots, audio, calls, and camera captures while communicating with resilient C2 infrastructure.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.