New Android Spyware Created by Russian Defense Contractor Found in the Wild

Dubbed Monokle, the mobile remote-access trojan has been
actively targeting Android phones since at least March 2016 and is
primarily being used in highly targeted attacks on a limited number
of people.

According to security researchers at Lookout, Monokle possesses
a wide range of spying functionalities and uses advanced data
exfiltration techniques, even without requiring root access to a
targeted device.

How Bad is Monokle Surveillance Malware

In particular, the malware abuses Android accessibility services to
exfiltrate data from a large number of popular third-party
applications, including Google Docs, Facebook messenger, Whatsapp,
WeChat, and Snapchat, by reading text displayed on a device’s
screen at any point in time.
The malware also extracts user-defined predictive-text dictionaries
to “get a sense of the topics of interest to a target,” and also
attempts to record the phone screen during a screen unlock event in
order to compromise the phone’s PIN, pattern or password.

Besides this, if the root access is available, the spyware
installs attacker-specified root CA certificates to the list of
trusted certificates on a compromised device, potentially enabling
the attackers to easily intercept encrypted SSL-protected network
traffic through Man-in-the-Middle (MiTM) attacks.

Other functionalities of Monokle includes:

• Track device location
• Record audio and calls
• Make screen recordings
• Keylogger and device-fingerprinting
• Retrieve browsing and call histories
• Take photos, videos, and screenshots
• Retrieve emails, SMSes, and Messages
• Steal contacts and calendar information
• making calls and sending text messages on behalf of
  victims
• Execute arbitrary shell commands, as root, if root access is
  available

In total, Monokle contains 78 different predefined commands, which
attackers can send through SMS, phone calls, email message exchange
through POP3 and SMTP, and inbound/outbound TCP connections,
instructing the malware to exfiltrate requested data and send it to
the attackers remote command-and-control servers.

Spyware Disguises as PornHub and Google Android Apps

According to the researchers, attackers are distributing Monokle
through fake apps that look just like Evernote, Google Play,
Pornhub, Signal, UC Browser, Skype, and other popular Android
apps.

Moreover, some recent samples of Monokle even come bundled with
Xposed modules that allow the malware to customize some system
features, eventually extending its ability to hook and hide
presence in the process list.

The malware package uses a DEX file in its assets folder that
“includes all cryptographic functions implemented in the open
source library “spongycastle,” various email protocols, extraction
and exfiltration of all data, serialization and deserialization of
data using the Thrift protocol, and rooting and hooking
functionality, among others.”

The new Android malware and its capabilities remind us of the
powerful surveillance malware Pegasus,
developed by Israel-based NSO
Group for both Apple iOS and Google Android devices.

However, unlike Russian spyware Monokle, Pegasus^[3] comes with powerful
zero-day exploits that install the spyware on a targeted device
with little to no user interaction.

Pegasus has previously been used to target human rights
activists and journalists, from Mexico^[4] to the United Arab
Emirates^[5] and again last year
against an Amnesty International staffer in Saudi
Arabia^[6].

Russian Defense Contractor STC Developed Monokle Malware

Monokle was developed by a Russia-based company, called Special
Technology Centre Ltd. (STC)—a private defense contractor known for
producing UAVs and Radio Frequency (RF) equipment for Russian
military as well as other government customers.

Monokle for iOS Under Development

Besides Android, researchers also came across some Monokle malware
samples, analysis of which revealed the existence of iOS versions
of Monokle targeting Apple devices, though the researchers found no
evidence of any active iOS infection as of now.
Some commands in the malware samples appear to serve no purpose as
part of the Android client and have likely been added
unintentionally, which suggests that the iOS versions of Monokle
may be under development.

Those commands include iOS functions for the keychain, iCloud
connections, Apple iWatch accelerometer data, iOS permissions, and
other iOS features or services.

According to Lookout researchers, Monokle is used in highly
targeted attacks on a limited number of people in the Caucasus
regions of Eastern Europe as well as individuals interested in
Islam and the Ahrar al-Sham militant group in Syria, and
individuals in the Central Asian nation and former Soviet republic
Uzbekistan.

For more information, you can head on the detailed
report^[7] published by
Lookout.

^[1][2]