CampaignPublished 16 Dec 2024

OSINT · Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

OSINT - Lookout Discovers Two Russian Android Spyware Families from Gamaredon APT

Impact

For European organizations, the impact of these spyware families could be significant if targeted, especially for entities involved in government, defense, critical infrastructure, or geopolitical affairs related to Russia and Ukraine. Compromise of Android devices could lead to leakage of sensitive communications, credentials, and intellectual property, undermining confidentiality and operational security. The spyware could also facilitate further network intrusion if mobile devices are used as pivot points. While the current threat level is low and no widespread exploitation is reported, the persistent nature of Gamaredon’s campaigns and their focus on espionage means European organizations should remain vigilant. The impact is particularly relevant for organizations with employees or partners using Android devices in sensitive roles, as mobile platforms often have less stringent security controls compared to traditional endpoints.

Defensive guidance

Specific mitigation recommendations include: 1) Implementing mobile device management (MDM) solutions to enforce security policies and monitor for suspicious app installations or behaviors on Android devices. 2) Educating users about the risks of installing apps from untrusted sources and the dangers of phishing or social engineering campaigns that could deliver spyware payloads. 3) Applying network-level protections such as DNS filtering and intrusion detection systems to identify and block command-and-control communications associated with known Gamaredon infrastructure. 4) Conducting regular threat intelligence updates and monitoring OSINT feeds for indicators of compromise related to these spyware families. 5) Encouraging the use of endpoint detection and response (EDR) tools that extend to mobile devices to detect anomalous activities. 6) Restricting permissions for apps on Android devices to minimize data exposure and potential spyware capabilities. 7) Collaborating with national cybersecurity agencies for timely alerts and guidance on emerging threats from Russian APT groups.

Indicators of compromise

Domains 105

llkeyvost.ddns.net
fiordmoss.ddns.net
winterknowing.ddns.net
weeklyoptional.ddns.net
ltkwark.ddns.net
ollymap.pw
wleak.pw
goos.pw
waltermanage.ddns.net
tokyoprepared.ddns.net

IP addresses 8

194.87.216.136
34.98.99.30
185.247.184.63
195.133.88.3
89.185.84.46
212.192.14.34
194.87.31.3
89.185.84.81

Hashes 36

2c7827f92a103db1b299f334043fbdc73805bbee11f4bfac195f672ba0464d22
114d2a25bb4c296f8ef5bfca4e8192b5aca9b169099ac6291139e68cfc7e37dc
8af63d7aa2142701116207f61e3e01c9e0239731e5bbbdf79114889b56ca46ea
ce6e5838f3ada452b64ffc6261e9bf74479bd31e83f77c7409c89564846db6a3
8407fed605805f0e7ef9628767d0aff1014e7231549b09f3c0d0cb723f07c48a
cb648ba5cce810e5ba17b89ca2c346bd3f0ad612834c225ec7b55871c4acc085
39cb17cb03a794e69eb4f0694e90e41a8cfb8480b82da82fcbd4a88dfe49930d
fd5fa718a7411b18845b76d7007db6b4431b1a2ce2f8b2cc047c0fff7c46161f
f0acf9558b7a4fcdaa119731ad5fb5bbdf5a704c9be9e929735a4679735989db
7de055018723b612dfa66a90c83a69afce7db918fb7fa88619833557c4fc61c3

Link 1

https://www.lookout.com/threat-intelligence/article/gamaredon-russian-android-surveillanceware

Text 4

Lookout has discovered BoneSpy and PlainGnome Android surveillance families and attributed them to the Russian Gamaredon (Primitive Bear, Shuckworm) APT group associated with the Federal Security Service (FSB). BoneSpy has been in use since at least 2021, while PlainGnome first appeared in 2024. Both families are still active at the time of writing. BoneSpy and PlainGnome target former Soviet states and focus on Russian-speaking victims. Lookout assesses this targeting may be related to worsening relations between these countries and Russia since the outbreak of the Ukraine invasion. Both BoneSpy and PlainGnome collect data such as SMS messages, call logs, phone call audio, photos from device cameras, device location, and contact lists. PlainGnome acts as a dropper for a surveillance payload, stored within the dropper package, while BoneSpy is deployed as a standalone application.
Blog
Extracted IOCs via GPT4o
Blog

File 4

67589a71c3f613ce4d7c74ee_67589a5b5ab2144c3b220bec_Screenshot_202024-12-10_20at_202.44.41_E2_80_AFPM.png
67589a71c3f613ce4d7c751c_67589a4dea143dc3466b8c8d_Screenshot_202024-12-10_20at_202.44.25_E2_80_AFPM.png
67589a71c3f613ce4d7c7516_67589a36e09031426f9eb27e_Screenshot_202024-12-10_20at_202.44.12_E2_80_AFPM.png
Extracted_IOC_List.csv

Community reviews

Loading reviews…