2-Extended Analysis-Full

Communities @ Risk 37EXTENDED ANALYSIS: 2.2 Cluster AnalysisMobile MalwareBACKGROUNDThe use of malware targeting mobile platforms in espionage campaigns is relativelyrare, but is likely a vector that will become more common due to the increasing ubiquityof mobile computing.During investigations of C2 servers associated with the Luckycat campaign, TrendMicro found two malicious Android APKs in early stages of development that couldcollect device information, as well as download and upload files by remote command.Based on the available information, it was unclear how the attackers intended todeliver the mobile malware to targets.In 2013, researchers at Kaspersky reported the compromise of an email account of ahigh-profile Tibetan activist that was then used by attackers to send targeted malwareto the activist’s contacts. The emails referenced the World Uyghur Congress andincluded a malicious APK file that appeared to be an application with information onthe event. The malware allowed attackers to collect data from infected devices includingcontacts, call logs, SMS messages, geolocation, and phone data (phone number, OSversion, phone model, and SDK version).Researchers in our group have also found evidence of commercial surveillance productsthat target multiple mobile platforms (e.g., Android, IOS, BlackBerry, Symbian)developed by Hacking Team and FinFisher.In other recent work, researchers found that participants in the Occupy Central protestsin Hong Kong received links through WhatsApp to an Android application thatappeared to be associated with the protest organizers, but was actually malware thatcould send a variety of information back to attackers.In our study, we identified the use of compromised Android applications sent as part ofa targeted attack against a prominent figure in the Tibetan community. This attack lever-