Bahamut Spyware Group Compromises Android Devices Via Fake VPN Apps

The Bahamut APT group has been focusing on Android people through a faux SecureVPN internet site due to the fact at least January 2022.

In accordance to a new advisory from Eset, the app made use of as part of this malicious marketing campaign was a trojanized model of possibly of two genuine VPN applications, SoftVPN or OpenVPN. In both of those situations, the applications had been repackaged with Bahamut adware code.

“We have been able to recognize at the very least 8 variations of these maliciously patched applications with code adjustments and updates remaining made accessible via the distribution internet site, which could possibly signify that the campaign is very well taken care of,” Eset wrote.

The security scientists defined that the most important objective of the application modifications was to exfiltrate sensitive user details and spy on victims’ messaging applications.

In specific, the faux SecureVPN Android apps could extract delicate info these as SMS messages, contacts, call logs, machine site and recorded phone calls.

They also enabled the spying of chat messages on numerous messaging apps, which includes WhatsApp, Signal, Viber, Telegram and Facebook Messenger.

Info exfiltration is performed through the keylogging functionality of the malware, which relies on Android’s accessibility providers. Eset advised that the campaign appears really specific, as the enterprise did not discover any circumstances in their telemetry information.

“We think that targets are cautiously picked due to the fact the moment the Bahamut spy ware is launched, it requests an activation important ahead of the VPN and spyware operation can be enabled. Both of those the activation essential and site website link are probably sent to targeted users,” reads the specialized publish-up.

Regardless of this, the advisory highlights that the Bahamut APT team, lively given that at least 2017, generally targets firms and people in the Center East and South Asia.

“Bahamut specializes in cyberespionage, and we imagine its intention is to steal sensitive information from its victims,” Eset wrote. “Bahamut is also referred to as a mercenary team offering hack-for-use solutions to a extensive assortment of clientele.”

The firm’s advisory will come months right after security scientists at Zimperium found a new Android spy ware household dubbed ‘RatMilad’ hoping to infect an organization machine in the Middle East.

Some parts of this article are sourced from:
www.infosecurity-journal.com