Android malware spying on Urdu-speaking residents of Gilgit-Baltistan

UPDATE (November 13^th, 2023): The web site has eliminated the “DOWNLOAD APP” button, though the malicious app remains to be hosted on its servers.

ESET researchers have recognized what seems to be a watering-hole assault on a regional information web site that delivers information about Gilgit-Baltistan, a disputed area administered by Pakistan. When opened on a cell machine, the Urdu model of the Hunza Information web site gives readers the chance to obtain the Hunza Information Android app immediately from the web site, however the app has malicious espionage capabilities. We named this beforehand unknown spy ware Kamran due to its package deal identify com.kamran.hunzanews. Kamran is a standard given identify in Pakistan and different Urdu-speaking areas; in Farsi, which is spoken by some minorities in Gilgit-Baltistan, it means lucky or fortunate.

The Hunza Information web site has English and Urdu variations; the English cell model doesn’t present any app for obtain. Nonetheless, the Urdu model on cell gives to obtain the Android spy ware. It’s value mentioning that each English and Urdu desktop variations additionally supply the Android spy ware; though, it’s not appropriate with desktop working programs. We reached out to the web site in regards to the Android malware. Nonetheless, previous to the publication of our blogpost, we didn’t obtain any response.

Key factors of the report:

• Android spy ware, which we named Kamran, has been distributed by way of a potential watering-hole assault on the Hunza Information web site.
• The malware targets solely Urdu-speaking customers in Gilgit-Baltistan, a area administered by Pakistan.
• The Kamran spy ware shows the content material of the Hunza Information web site and incorporates customized malicious code.
• Our analysis exhibits that no less than 20 cell gadgets had been compromised.

Upon launching, the malicious app prompts the consumer to grant it permissions to entry numerous knowledge. If accepted, it gathers knowledge about contacts, calendar occasions, name logs, location info, machine information, SMS messages, photos, and so forth. As this malicious app has by no means been provided via the Google Play retailer and is downloaded from an unidentified supply known as Unknown by Google, to put in this app, the consumer is requested to allow the choice to put in apps from unknown sources.

The malicious app appeared on the web site someday between January 7^th, 2023, and March 21^st, 2023; the developer certificates of the malicious app was issued on January 10, 2023. Throughout that point, protests had been being held in Gilgit-Baltistan for numerous causes encompassing land rights, taxation issues, extended energy outages, and a decline in sponsored wheat provisions. The area, proven within the map in Determine 1, is beneath Pakistan’s administrative governance, consisting of the northern portion of the bigger Kashmir area, which has been the topic of a dispute between India and Pakistan since 1947 and between India and China since 1959.

Overview

Hunza Information, doubtless named after the Hunza District or the Hunza Valley, is a web based newspaper delivering information associated to the Gilgit-Baltistan area.

The area, with a inhabitants of round 1.5 million, is known for the presence of a number of the highest mountains globally, internet hosting 5 of the esteemed “eight-thousanders” (mountains that peak at greater than 8,000 meters above sea degree), most notably K2, and is due to this fact continuously visited by worldwide vacationers, trekkers, and mountaineers. Due to the protests in spring 2023, and extra ones occurring in September 2023, the US and Canada have issued journey advisories for this area, and Germany steered vacationers ought to keep knowledgeable concerning the present scenario.

Gilgit-Baltistan can also be an essential crossroad due to the Karakoram Freeway, the one motorable highway connecting Pakistan and China, because it permits China to facilitate commerce and vitality transit by accessing the Arabian Sea. The Pakistani portion of the freeway is at present being reconstructed and upgraded; the efforts are financed by each Pakistan and China. The freeway is continuously blocked by harm brought on by climate or protests.

The Hunza Information web site gives content material in two languages: English and Urdu. Alongside English, Urdu holds nationwide language standing in Pakistan, and in Gilgit-Baltistan, it serves because the frequent or bridge language for interethnic communications. The official area of Hunza Information is hunzanews.web, registered on Might 22^nd, 2017, and has been persistently publishing on-line articles since then, as evidenced by Web Archive knowledge for hunzanews.web.

Previous to 2022, this on-line newspaper additionally used one other area, hunzanews.com, as indicated within the web page transparency info on the location’s Fb web page (see Determine 2) and the Web Archive data of hunzanews.com, Web Archive knowledge additionally exhibits that hunzanews.com had been delivering information since 2013; due to this fact, for round 5 years, this on-line newspaper was publishing articles by way of two web sites: hunzanews.web and hunzanews.com. This additionally signifies that this on-line newspaper has been energetic and gaining on-line readership for over 10 years.

In 2015, hunzanews.com began to supply a official Android utility, as proven in Determine 3, which was accessible on the Google Play retailer. Based mostly on accessible knowledge we imagine two variations of this app had been launched, with neither containing any malicious performance. The aim of those apps was to current the web site content material to readers in a user-friendly method.

Within the second half of 2022, the brand new web site hunzanews.web underwent visible updates, together with the removing of the choice to obtain the Android app from Google Play. Moreover, the official app was taken down from the Google Play retailer, doubtless attributable to its incompatibility with the most recent Android working programs.

For a couple of weeks, from no less than December 2022 till January 7^th, 2023, the web site offered no choice to obtain the official cell app, as proven in Determine 4.

Based mostly on Web Archive data, it’s evident that no less than since March 21^st, 2023, the web site reintroduced the choice for customers to obtain an Android app, accessible by way of the DOWNLOAD APP button, as depicted in Determine 5. There isn’t a knowledge for the interval between January 7^th and March 21^st, 2023, which might assist us pinpoint the precise date of the app’s reappearance on the web site.

When analyzing a number of variations of the web site, we got here throughout one thing attention-grabbing: viewing the web site in a desktop browser in both language model of Hunza Information – English (hunzanews.web) or Urdu (urdu.hunzanews.web) – prominently shows the DOWNLOAD APP button on the high of the webpage. The downloaded app is a local Android utility which can’t be put in on a desktop machine and compromise it.

Nonetheless, on a cell machine, this button is solely seen on the Urdu language variant (urdu.hunzanews.web), as proven in Determine 6.

With a excessive diploma of confidence, we are able to affirm that the malicious app is particularly focused at Urdu-speaking customers who entry the web site by way of an Android machine. The malicious app has been accessible on the web site because the first quarter of 2023.

Clicking on the DOWNLOAD APP button triggers a obtain from https://hunzanews[.]web/wp-content/uploads/apk/app-release.apk. As this malicious app has by no means been provided via the Google Play retailer and is downloaded from a third-party website to put in this app, the consumer is requested to allow the non-default, Android choice to put in apps from unknown sources.

The malicious app, referred to as Hunza Information, is beforehand unknown spy ware that we named Kamran and that’s analyzed within the Kamran part beneath.

ESET Analysis reached out to Hunza Information concerning Kamran. Earlier than the publication of our blogpost we didn’t obtain any type of suggestions or response from the web site’s facet.

Victimology

Based mostly on the findings from our analysis, we had been capable of determine no less than 22 compromised smartphones, with 5 of them being situated in Pakistan.

Kamran

Kamran is beforehand undocumented Android spy ware characterised by its distinctive code composition, distinct from different, identified spy ware. ESET detects this spy ware as Android/Spy.Kamran.

We recognized just one model of a malicious app containing Kamran, which is the one accessible to obtain from the Hunza Information web site. As defined within the Overview part, we’re unable to specify the precise date on which the app was positioned on the Hunza Information web site. Nonetheless, the related developer certificates (SHA-1 fingerprint: DCC1A353A178ABF4F441A5587E15644A388C9D9C), used to signal the Android app, was issued on January 10^th, 2023. This date gives a flooring for the earliest time that the malicious app was constructed.

In distinction, official purposes from Hunza Information that had been previously accessible on Google Play had been signed with a unique developer certificates (SHA-1 fingerprint: BC2B7C4DF3B895BE4C7378D056792664FCEEC591). These clear and legit apps exhibit no code similarities with the recognized malicious app.

Upon launching, Kamran prompts the consumer to grant permissions for accessing numerous knowledge saved on the sufferer’s machine, equivalent to contacts, calendar occasions, name logs, location info, machine information, SMS messages, and pictures. It additionally presents a consumer interface window, providing choices to go to Hunza Information social media accounts, and to pick out both the English or Urdu language for loading the contents of hunzanews.web, as proven in Determine 7.

If the abovementioned permissions are granted, the Kamran spy ware robotically gathers delicate consumer knowledge, together with:

• SMS messages
• contacts listing
• name logs
• calendar occasions
• machine location
• listing of put in apps
• acquired SMS messages
• machine information
• photos

Apparently, Kamran identifies accessible picture information on the machine (as depicted in Determine 8), obtains the file paths for these photos, and shops this knowledge in an images_db database, as demonstrated in Determine 9. This database is saved within the malware’s inner storage.

All sorts of knowledge, together with the picture information, are uploaded to a hardcoded command and management (C&C) server. Apparently, the operators opted to make the most of Firebase, an internet platform, as their C&C server: https://[REDACTED].firebaseio[.]com. The C&C server was reported to Google, because the platform is offered by this expertise firm.

You will need to notice that the malware lacks distant management capabilities. Because of this, consumer knowledge is exfiltrated by way of HTTPS to the Firebase C&C server solely when the consumer opens the app; knowledge exfiltration can’t run within the background when the app is closed. Kamran has no mechanism monitoring what knowledge has been exfiltrated, so it repeatedly sends the identical knowledge, plus any new knowledge assembly its search standards, to its C&C.

Conclusion

Kamran is beforehand unknown Android spy ware focusing on Urdu-speaking folks within the Gilgit-Baltistan area. Our analysis signifies that the malicious app containing Kamran has been distributed since no less than 2023 by way of what most likely is a watering-hole assault on a neighborhood, on-line newspaper named Hunza Information.

Kamran demonstrates a novel codebase distinct from different Android spy ware, stopping its attribution to any identified superior persistent risk (APT) group.

This analysis additionally exhibits that it is very important reiterate the importance of downloading apps solely from trusted and official sources.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis gives non-public APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

Recordsdata

SHA-1	Package deal identify	Detection	Description
0F0259F288141EDBE4AB2B8032911C69E03817D2	com.kamran.hunzanews	Android/Spy.Kamran.A	Kamran spy ware.

Community

IP	Area	Internet hosting supplier	First seen	Particulars
34.120.160[.]131	[REDACTED].firebaseio[.]com	Google LLC	2023-07-26	C&C server.
191.101.13[.]235	hunzanews[.]web	Area.com, LLC	2017-05-22	Distribution web site.

MITRE ATT&CK methods

This desk was constructed utilizing model 13 of the MITRE ATT&CK framework.

Tactic	ID	Identify	Description
Discovery	T1418	Software program Discovery	Kamran spy ware can get hold of a listing of put in purposes.
	T1420	File and Listing Discovery	Kamran spy ware can listing picture information on exterior storage.
	T1426	System Data Discovery	Kamran spy ware can extract details about the machine, together with machine mannequin, OS model, and customary system info.
Assortment	T1533	Knowledge from Native System	Kamran spy ware can exfiltrate picture information from a tool.
	T1430	Location Monitoring	Kamran spy ware tracks machine location.
	T1636.001	Protected Consumer Knowledge: Calendar Entries	Kamran spy ware can extract calendar entries.
	T1636.002	Protected Consumer Knowledge: Name Logs	Kamran spy ware can extract name logs.
	T1636.003	Protected Consumer Knowledge: Contact Listing	Kamran spy ware can extract the machine’s contact listing.
	T1636.004	Protected Consumer Knowledge: SMS Messages	Kamran spy ware can extract SMS messages and intercept acquired SMS.
Command and Management	T1437.001	Utility Layer Protocol: Net Protocols	Kamran spy ware makes use of HTTPS to speak with its C&C server.
	T1481.003	Net Service: One-Manner Communication	Kamran makes use of Google’s Firebase server as its C&C server.
Exfiltration	T1646	Exfiltration Over C2 Channel	Kamran spy ware exfiltrates knowledge utilizing HTTPS.