MalwarePublished 25 Aug 2025Updated 24 Sep 2025

Android backdoor spies on Russian business employees

Source AlienVault OTX General

Description

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging apps and browsers, and keylogging. Distributed via messenger apps, it requests numerous system permissions and connects to C2 servers for commands. The backdoor can transmit SMS messages, contact lists, call logs, location data, and captured audio/video streams. It uses Accessibility Service to log keystrokes and intercept content from specific apps like Telegram and Chrome. The malware is believed to be used for targeted attacks rather than mass distribution.

Impact

For European organizations, particularly those with business ties or operations involving Russian entities or employees, this backdoor represents a significant espionage risk. The malware's ability to capture sensitive communications, credentials, and location data can lead to severe confidentiality breaches, intellectual property theft, and operational disruption. Organizations with employees traveling to or collaborating with Russian business partners may inadvertently become targets, risking exposure of proprietary information or strategic plans. The spyware's stealthy nature and use of legitimate Android features complicate detection and response, potentially allowing prolonged unauthorized access. Additionally, the malware's capability to intercept communications from widely used apps like Telegram and Chrome poses a threat to the integrity and privacy of corporate communications. While the primary focus is on Russian business representatives, the malware could be repurposed or spread to European targets through similar social engineering tactics, especially in multinational corporations with cross-border communications. The impact on availability is limited, but the compromise of confidentiality and integrity is substantial, potentially undermining trust and causing reputational damage.

Defensive guidance

European organizations should implement targeted mobile security strategies beyond generic advice. First, enforce strict policies on app installation, especially discouraging installation of apps from unverified sources or unsolicited links received via messenger apps. Deploy mobile threat defense (MTD) solutions capable of detecting suspicious behaviors such as unauthorized use of Accessibility Services and unusual permission requests. Conduct regular security awareness training focused on social engineering risks related to messenger apps and fake antivirus apps. Implement endpoint detection and response (EDR) tools that extend to mobile devices to monitor for anomalous network connections to known or suspicious C2 servers. Organizations should also consider restricting or monitoring the use of Accessibility Services on corporate devices, as misuse is a common vector for spyware. Network-level controls such as DNS filtering and blocking known malicious IP addresses associated with the malware's C2 infrastructure can reduce the risk of data exfiltration. For employees working with or in Russia, consider additional device hardening measures, including disabling unnecessary permissions and using containerization or sandboxing to isolate sensitive apps. Incident response plans should include procedures for rapid identification and remediation of mobile spyware infections.

Indicators of compromise

Domains 52

refs.search
24biliberdiki.ru
24lasofyu.ru
advasd.ru
alegriki.ru
asasdffgasd.online
biliberdiki.ru
bountyhunter.pro
cadabrabro.ru
dertels.ru

IP addresses 120

103.71.22.100
103.71.22.206
103.71.22.52
103.71.22.68
136.243.209.194
136.243.209.196
138.124.15.61
138.124.182.198
138.124.31.177
138.124.31.191

Hashes 51

014120441aa6cd24ad2914e06ae4f5fa
01c1f9a597468532db6e05e322a0abc3
04395be7adfa6402645063aa54e97e58
32d65e7f78def3004a46a17f838fac43
3c4ad3e5cbe335afa9e112d14cb0694e
4360b3705243ef501094ed160a09f42f
5d55de8f9599c75e21db29d80126bad7
657498bae0f1eced3e7e83d05945ad56
6d4fe681db84c9161b1d6b3564831626
72bc7a1723eb96137a26b80da9bf2169

Community reviews

Loading reviews…