SpyNote Is Using Android Spyware to Target Financial Institutions
- Written by Ari Denial Cybersecurity & Tech Writer
Since October 2022, financial institutions have been targeted by a new version of Android malware called SpyNote (aka SpyMax).
“The developer of SpyNote, who was previously selling it to individuals via his Telegram channel, made the source code public on GitHub. This has helped hackers further develop and distribute the spyware, often also targeting banking institutions,” said ThreatFabric .
SpyNote is a feature-rich application that can install arbitrary apps, gather SMS messages, calls, videos, and audio recordings, track GPS locations, and even prevent attempts to uninstall the app.
According to ThreatFabric, “One of the main differences between the first variants, SpyNote.A and SpyNote.B, and the latest one, SpyNote.C, is the campaign objective. SpyNote.C has been the first variant to openly target banking applications, impersonating a large number of reputable financial institutions like HSBC, Deutsche Bank, Kotak Bank, and BurlaNubank, as well as others to well-known applications like WhatsApp, Facebook, and Google Play.”
Similarly to other banking malware, SpyNote requests access to accessibility services to extract two-factor authentication (2FA) codes from Google Authenticator and record keystrokes to deceive banking credentials.
SpyNote utilizes Android’s MediaProjection API to capture screen content and steal Facebook and Gmail passwords. It is also able to pose as the official Google Play Store service and other generic applications in the productivity, gaming, and wallpapers categories.
As per ThreatFabric, these are a few of the SpyNote artifacts that are mainly delivered through smishing attacks:
- Bank of America Confirmation (Package Name – yps.eton.application)
- Kotak Bank (Package Name – splash.app.main)
- HSBC UK Mobile Banking (Package Name – com.employ.mb)
- BurlaNubank (Package Name – com.appser.verapp)
- Deutsche Bank Mobile (Package Name – com.reporting.efficiency)
- Current Activity (Package Name – com.willme.topactivity)
- Conversations_ (Package Name – com.appser.verapp)
- Virtual SimCard (Pacakge Name – cobi0jbpm.apvy8vjjvpser.verapchvvhbjbjq)
The Dutch Security Firm estimated that 87 different customers purchased SpyNote.C between August 2021 and October 2022 after its developer advertised it on Telegram under the name CypherRat. However, it appears that several criminal groups are co-opting CypherRat in their campaigns since SpyNote became open source in October 2022.
“SpyNote will keep using Accessibility Service to collect essential data from users’ devices and it will be able to develop towards a successful distribution. We also believe that the trend will continue adopting better security measures like obfuscation and packers to help safeguard the program itself. Different forks of SpyNote will likely continue appearing, following the release of its source code”, the company predicted.
For Two Weeks, Confidential Emails From the US Military Were Made Publicly Accessible
- Written by Ari Denial Cybersecurity & Tech Writer
An investigation is underway by the Department of Defense and Microsoft regarding an insecure server that resulted in the exposure of emails and data from the U.S. Special Operations Command (USSOCOM). The information compromised was deemed sensitive but unclassified.
The server that was compromised contained an internal mailbox system, which stored approximately three terabytes of military emails, including many related to the U.S. Special Operations Command (USSOCOM). It is the military unit responsible for carrying out special military operations.
Due to a misconfiguration, the server was left without a password, resulting in unrestricted access to the sensitive mailbox data through a web browser. This allowed anyone with knowledge of the server’s IP address to access the information without any additional authentication.
The exposed server was discovered by Anurag Sen, a reputable security researcher who is known for identifying instances of inadvertently published sensitive data online. Sen discovered the server and provided detailed information about the incident.
In addition to containing a large volume of internal military emails dating back several years, the compromised server also included a completed SF-86 questionnaire. These questionnaires are typically filled out by federal employees seeking a security clearance and contain highly confidential personal and health information.
According to Ken McGraw, a spokesperson for USSOCOM, an investigation into the incident began on Monday, and as of Tuesday, they can confirm that no one had hacked into the information systems of the U.S. Special Operations Command.
According to Sen, “I couldn’t confirm what was the reason, only a DoD internal investigation can tell us more about details. But as from my past experience, it’s likely the result of misconfiguration done by human error.”
Inadvertently exposing internal data to the internet is not an uncommon occurrence for large organizations. However, given that this incident involves a Department of Defense email server, US officials are likely to be concerned.
