Blog

ESET researchers have recognized two lively campaigns concentrating on Android customers, the place the menace actors behind the instrument are attributed to the China-aligned APT group GREF. Probably lively since July 2020 and since July 2022, respectively, the campaigns have distributed the Android BadBazaar espionage code via the Google Play retailer, Samsung Galaxy Retailer, and devoted web sites representing the malicious apps Sign Plus Messenger and FlyGram. The menace actors patched the open-source Sign and Telegram apps for Android with malicious code that now we have recognized as BadBazaar.

Key factors of the report:

• ESET Analysis found trojanized Sign and Telegram apps for Android, known as Sign Plus Messenger and FlyGram, on Google Play and Samsung Galaxy Retailer; each apps have been later faraway from Google Play.
• The malicious code present in these apps is attributed to the BadBazaar malware household, which has been used previously by a China-aligned APT group known as GREF.
• BadBazaar malware has beforehand been used to focus on Uyghurs and different Turkic ethnic minorities. FlyGram malware was additionally seen shared in a Uyghur Telegram group, which aligns with earlier concentrating on of the BadBazaar malware household.
• FlyGram can entry Telegram backups if the consumer enabled a particular function added by the attackers; the function was activated by no less than 13,953 consumer accounts.
• Sign Plus Messenger represents the primary documented case of spying on a sufferer’s Sign communications by secretly autolinking the compromised machine to the attacker’s Sign machine.

Primarily based on our telemetry, we have been in a position to establish lively Android campaigns the place an attacker uploaded and distributed malicious apps that go by the names Sign Plus Messenger and FlyGram by way of the Google Play retailer, Samsung Galaxy Retailer, and devoted web sites, mimicking the Sign software (signalplus[.]org) and a Telegram different app (flygram[.]org).

The aim of those trojanized apps is to exfiltrate consumer knowledge. Particularly, FlyGram can extract primary machine data, but additionally delicate knowledge, corresponding to contact lists, name logs, and the listing of Google Accounts. Furthermore, the app is able to exfiltrating some data and settings associated to Telegram; nonetheless, this knowledge doesn’t embody the Telegram contact listing, messages, or another delicate data. Nonetheless, if customers allow a particular FlyGram function that permits them to again up and restore Telegram knowledge to a distant server managed by the attackers, the menace actor can have full entry to those Telegram backups, not solely the collected metadata. You will need to be aware that these backups don’t include precise messages. Throughout the evaluation of this function, we realized that the server assigns a singular ID to each newly created consumer account. This ID follows a sequential sample, indicating {that a} minimal of 13,953 FlyGram accounts had activated this function.

Sign Plus Messenger collects related machine knowledge and delicate data; its major aim, nonetheless, is to spy on the sufferer’s Sign communications – it could possibly extract the Sign PIN quantity that protects the Sign account, and misuses the hyperlink machine function that permits customers to hyperlink Sign Desktop and Sign iPad to their telephones. This spying method stands out because of its uniqueness, because it differs from the performance of another recognized malware.

The video above exhibits how the menace actor hyperlinks the compromised machine to the attacker’s Sign account with none consumer interplay; it additionally explains how customers can verify whether or not their Sign account has been linked to a different machine.

As a Google App Protection Alliance companion, ESET recognized the newest model of the Sign Plus Messenger as malicious and promptly shared its findings with Google. Following our alert, the app was faraway from the shop. FlyGram wasn’t flagged as malicious by ESET on the time when it initially grew to become obtainable on the Google Play retailer.

On April 27^th, 2023, we reported Sign Plus Messenger to each Google Play and Samsung Galaxy Retailer. Google took motion and eliminated the app on Could 23^rd, 2023. FlyGram was taken down from Google Play someday after January 6^th, 2021. On the time of writing, each apps are nonetheless obtainable on the Samsung Galaxy Retailer.

Overview

The malicious Sign Plus Messenger app was initially uploaded to Google Play on July 7^th, 2022, and it managed to get put in greater than 100 occasions. Nonetheless, the Galaxy Retailer doesn’t present any details about the app’s preliminary add date or the variety of installations. Its presence on each platforms is depicted in Determine 1.

Each apps have been created by the identical developer, share the identical malicious options, and the app descriptions on each shops check with the identical developer web site, signalplus[.]org. The area was registered on February 15^th, 2022, and supplies a hyperlink to obtain the malicious Sign Plus Messenger software both from Google Play or straight from the web site, as proven in Determine 2. No matter the place the app is downloaded from – be it the Google Play model, the Samsung Galaxy Retailer model, or the web site model – all three downloads lead to acquiring a maliciously modified (or patched) model of the open-source Sign for Android app.

The malicious FlyGram app was initially uploaded to Google Mess around June 4^th, 2020, and it managed to garner greater than 5,000 installations earlier than being taken down someday after January 6^th, 2021.

Each FlyGram apps have been signed utilizing the an identical code-signing certificates. Furthermore, the identical FlyGram app can also be obtainable for obtain from its devoted web site flygram[.]org. This web site was registered on April 6^th, 2020, and supplies a hyperlink to obtain the malicious FlyGram software straight from the web site, as you’ll be able to see in Determine 3.

Primarily based on code similarities, we will assign Sign Plus Messenger and FlyGram to the BadBazaar malware household, which has been beforehand used towards Uyghurs and different Turkic ethnic minorities exterior of China. BadBazaar was attributed to the China-aligned APT15 group by Lookout; beneath we clarify why we restrict attribution to the GREF group, and why we’re at the moment unable to hyperlink GREF to APT15, however proceed to watch the scenario. Additional particulars in regards to the BadBazaar discovery timeline can be found in Determine 4.

Victimology

Our telemetry reported detections on Android gadgets from Australia, Brazil, Denmark, the Democratic Republic of the Congo, Germany, Hong Kong, Hungary, Lithuania, the Netherlands, Poland, Portugal, Singapore, Spain, Ukraine, america, and Yemen.

Primarily based on our analysis, aside from distribution from the official Google Play retailer and Samsung Galaxy Retailer, potential victims have been additionally lured to put in the FlyGram app from a Uyghur Telegram group centered on Android app sharing, which now has greater than 1,300 members.

On July 26^th, 2020, one of many group customers posted a hyperlink to FlyGram on the Google Play retailer with an outline to obtain a multilanguage Telegram app, as proven in Determine 6. This may assist to establish who focused Uyghurs with the malicious FlyGram software.

Primarily based on obtainable data on official app shops, we will’t inform who has been focused by the marketing campaign, because the apps have been obtainable for obtain with out area restrictions.

Attribution to GREF

• Vital code similarities between the Sign Plus Messenger and FlyGram samples, and the BadBazaar malware household, which Lookout attributes to the GREF cluster of APT15. To the most effective of our data, this malware household is exclusive to GREF.
• Overlap within the concentrating on: the malicious FlyGram app used a Uyghur Telegram group as one of many distribution mechanisms. This aligns with the concentrating on of different Android trojans beforehand utilized by GREF (BadBazaar, SilkBean, DoubleAgent, CarbonSteal, and GoldenEagle).

Sign Plus Messenger and FlyGram additionally include the identical code as in BadBazaar to verify whether or not the machine operator is Chinese language: see Determine 9.

Technical evaluation

Trojanized Sign – Sign Plus Messenger app

After preliminary app begin, the consumer has to log into Sign Plus Messenger by way of authentic Sign performance, identical to they’d with the official Sign app for Android. As soon as logged in, Sign Plus Messenger begins to speak with its command and management (C&C) server, positioned at signalplus[.]org:4332. Throughout this communication, the app sends the server varied machine data, corresponding to: IMEI quantity, telephone quantity, MAC handle, operator particulars, location knowledge, Wi-Fi data, Sign PIN quantity that protects the account (if enabled by the consumer), emails for Google accounts, and phone listing. The server request is seen in Determine 10.

 

Legit Sign apps present a function that permits customers to hyperlink Sign Desktop and Sign iPad to their telephones to speak conveniently throughout a number of gadgets. To correctly hyperlink extra Sign gadgets to a smartphone, the consumer first must scan a QR code displayed on a tool they want to pair. After scanning, the consumer grants permission for the connection by tapping on the Hyperlink machine button, as displayed in Determine 11. The QR code comprises a singular URI with a generated ID and key, guaranteeing safe and individualized linking for every new QR code. An instance of such URI is sgnl://linkdevice?uuid=<redacted>fV2MLK3P_FLFJ4HOpA&pub_key=<redacted>1cCVJIyt2uPJK4fWvXt0m6XEBN02qJG7pcpercent2BmvQa.

Sign Plus Messenger can spy on Sign messages by misusing the hyperlink machine function. It does this by robotically connecting the compromised machine to the attacker’s Sign machine. This methodology of spying is exclusive, as we haven’t seen this performance being misused earlier than by different malware, and that is the one methodology by which the attacker can acquire the content material of Sign messages.

BadBazaar, the malware liable for the spying, bypasses the standard QR code scan and consumer click on course of by receiving the required URI from its C&C server, and straight triggering the required motion when the Hyperlink machine button is clicked. This allows the malware to secretly hyperlink the sufferer’s smartphone to the attacker’s machine, permitting them to spy on Sign communications with out the sufferer’s data, as illustrated in Determine 12.

 

ESET Analysis has knowledgeable Sign’s builders about this loophole. The encrypted messaging service indicated that menace actors can alter the code of any messaging app and put it on the market in a misleading or deceptive method. On this case, if the official Sign shoppers have been to show a notification each time a brand new machine is linked to the account, the faux model may merely disable that code path to bypass the warning and conceal any maliciously linked gadgets. The one approach to stop changing into a sufferer of a faux Sign – or another malicious messaging app – is to obtain solely official variations of such apps, solely from official channels.

Throughout our analysis, the server hasn’t returned to the machine a URI for linking, indicating that is almost certainly enabled just for particularly focused customers, based mostly on the info beforehand despatched by the malware to the C&C server.

To grasp and replicate the habits, we used the Frida instrumentation toolkit to simulate malicious habits and autolinked our compromised Sign Android machine (sufferer) to our Sign Desktop machine (attacker), working on a laptop computer. This linking course of occurred silently, with none interplay or notification to the consumer.

To make sure that a Sign account will not be linked to a different machine, the consumer must go to Settings -> Linked gadgets. This supplies a means for customers to detect any unauthorized linkages to their Sign account and take acceptable actions to safe their communications, as BadBazaar can’t cover an attacker-connected machine from the Linked gadgets menu, as depicted in Determine 13.

 

BadBazaar makes use of proxy servers which can be obtained from the C&C server. The malware can obtain as much as six completely different proxy servers, which check with subdomains of the C&C server.

All proxy servers offered by Sign Plus Messenger are:

• proxy1.signalplus[.]org    154.202.59[.]169
• proxy2.signalplus[.]org    92.118.189[.]164
• proxy3.signalplus[.]org    45.154.12[.]151
• proxy4.signalplus[.]org    45.154.12[.]202
• proxy5.signalplus[.]org    103.27.186[.]195
• proxy6.signalplus[.]org    103.27.186[.]156

The function to make use of a proxy server by the app will not be carried out by the attacker; as an alternative, authentic Sign proxy performance is used however routed via the attacker’s server as an alternative. In consequence, the attacker’s proxy server can presumably log some metadata, however can’t decrypt knowledge and messages which can be despatched or obtained by Sign itself.

Trojanized Telegram – FlyGram app

After preliminary app launch, the consumer has to log into the FlyGram app by way of its authentic Telegram performance, as is important for the official Telegram app. Earlier than the login is full, FlyGram begins to speak with the C&C server positioned at flygram[.]org:4432 by sending primary machine data corresponding to: IMEI quantity, MAC handle, operator identify, machine language, and time zone. Primarily based on the server’s response, BadBazaar features the power to exfiltrate additional delicate data from the machine, together with:

• contact listing,
• name logs,
• listing of put in apps,
• listing of Google accounts,
• machine location, and
• Wi-Fi data (IP handle, SSID, BSSID, MAC handle, gateway, DNS, native community machine scan discovery).

FlyGram also can obtain a URL from the C&C server to obtain an replace; see Determine 14. The downloaded replace (flygram.apk) will not be dynamically loaded as an extra payload, however must be manually put in by the consumer. Throughout our examination, we have been unable to entry the replace file because the obtain hyperlink was not lively.

BadBazaar can exfiltrate inside Telegram information positioned within the /knowledge/knowledge/org.telegram.messenger/shared_prefs listing. These information include data and settings associated to Telegram, such because the account token, the final known as quantity, and the app language. Nonetheless, they don’t embody the Telegram contact listing, messages, or another delicate knowledge.

To hold out the exfiltration course of, BadBazaar compresses the content material of this listing, excluding information with .jpg or .png extensions. The compressed knowledge is then saved within the file /knowledge/knowledge/org.telegram.FlyGram/cache/tgmcache/tgdata.rc. Lastly, the malware sends this compressed file to the C&C server, as proven in Determine 15.

The BadBazaar actors took steps to guard their FlyGram app from being intercepted throughout community visitors evaluation by malware analysts or automated sandbox instruments that try to establish the C&C server and knowledge exfiltration actions. They achieved this safety via a method known as SSL pinning.

SSL pinning is carried out within the org.telegram.Api.Utils.CertUtils class, as proven in Determine 16. The certificates is saved within the sources listing of the APK file, particularly within the /res/uncooked/telemon_client.cer file utilizing WMSvc-WIN-50QO3EIRQVP because the frequent identify (CN). This SSL pinning mechanism ensures that solely encrypted communication with the predefined certificates is allowed, making it troublesome for outsiders to intercept and analyze the community visitors between the FlyGram app and its C&C server. In distinction, the Sign Plus Messenger app doesn’t make use of SSL pinning, which suggests it doesn’t have this particular stage of safety in place.

 

On prime of its authentic Telegram performance, FlyGram builders carried out a Cloud Sync function that permits the customers to again up and restore Telegram contacts, profile photos, teams, channels, and so on. (see Determine 17). To make use of this function, the consumer first must create an account. The account is created utilizing the attacker’s C&C server API (flygram[.]org:4432); as soon as the account is ready up, customers can add their backups to the attacker’s C&C server or retrieve their earlier backups from there.

 

Throughout our in-depth examination of the Cloud Sync API, we made an attention-grabbing discovery. The server supplies a definite ID for every newly created consumer account. This ID is a singular worth that will increase sequentially (by one) with every new account. By analyzing these ID values, we will estimate the variety of customers who’ve put in FlyGram and signed up for the Cloud Sync function. On the time of our evaluation, our final check account was assigned the ID worth 13,953 (see Determine 18), indicating that at the moment 13,953 customers (together with us two occasions) had created accounts with the Cloud Sync function enabled.

 

FlyGram additionally makes use of proxy servers obtained from the C&C server; we noticed these 5 proxy servers:

• 45.63.89[.]238:1011
• 45.133.238[.]92:6023
• 217.163.29[.]84:7011
• 185.239.227[.]14:3023
• 62.210.28[.]116:2011

To allow the proxy server performance, the attackers didn’t implement it straight into the app. As an alternative, they utilized the authentic Telegram performance however rerouted it via their very own servers. In consequence, the attacker’s proxy server might be able to log some metadata, but it surely can not decrypt the precise knowledge and messages exchanged inside Telegram itself. Not like Sign Plus Messenger, FlyGram lacks the power to hyperlink a Telegram account to the attacker or intercept the encrypted communications of its victims.

Conclusion

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis gives personal APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

Information

This desk was constructed utilizing model 13 of the MITRE ATT&CK framework.