Data vulnerable to cyberattacks | New Android malware in circulation
Security researchers have discovered a new Android malware, which appears to use the same shared-hosting infrastructure previously used by Russian APT group Turla. The malware has not been linked to its creator. Researchers have not yet discovered how the Android malware is distributed.
In order to deceive the user it may pretend to be a system component. It is unclear how the Android spyware abuses the Android Accessibility service, whether it’s by tricking the user into approving an access request, or if grants these requests automatically. After getting the permissions, this Android spyware removes its icon from the victim’s device and runs in the background. This is strange for malware that usually tries to remain hidden from the victim. The Android malware gathers a lot of information, makes data vulnerable to cyberattacks, thanks to the permissions above, and sends it in a JSON-formatted string to 82.146.35[.]240, which is based in Russia.
When Lab52 started to analyze the app, they were able to see that it downloads more payloads on the device. The app, distributed through Google Play, infected 50,000 more devices this February. You can read how to prevent cybersecurity issues from malicious attacks on the cyberspace here or here.
Very useful information on cybersecurity and digital infrastructure you can find from an U.S. official Agency (CISA) by following the link, https://www.cisa.gov/uscert/ics/content/overview-cyber-vulnerabilities . Users by knowing well the control system can understand more easily what makes data vulnerable to cyberattacks.
Author: PC-GR
The World of Technology
