Dark Caracal Campaign Breaks New Ground with Focus on Mobile Devices

This is the first known global-scale campaign primarily focused on stealing data from Android devices, Lookout and EFF say.

An advanced persistent threat (APT) group operating out of a building belonging to a Lebanese intelligence agency in Beirut has stolen hundreds of gigabytes of data from Android devices and desktop systems belonging to thousands of victims in over 20 countries, including the US.
Targets of the global cyber-espionage campaign by the so-called Dark Caracal group have included government and military personnel, defense contactors, activists, and journalists in North America, Europe, and Asia, researchers from Lookout and the Electronic Frontier Foundation said in a
report
last week.
The two organizations described Dark Caracals activities as targeting multiple platforms globally but being especially noteworthy for its unprecedented focus on mobile devices. This is one of the first publicly documented mobile APT actors known to execute espionage on a global scale, Lookout and EFF said in the report.
Michael Flossman, lead of security research at Lookout, says available data suggests Dark Caracal began operations in 2012 and that some of its campaigns were still operational through the fall and winter of 2016 and into 2017. However, significant portions of Dark Caracals infrastructure no longer appear to be live, he says.
Attackers are increasingly going after mobile devices because of the access to both personal and corporate data these devices contain or can grant access to, Flossman says. When it comes to malicious actors creating and deploying an Android surveillance capability, the barrier to entry is low and a high technical sophistication is not a prerequisite for success.
Lookout and EFF have released more than 90 indicators of compromise associated with the Dark Caracal threat. The list includes 11 Android indicators of compromise (IOCs) and 26 IOCs for desktop malware targeting Windows, Linux, and Mac systems.
A lot of the data that Dark Caracal has stolen was obtained from Android devices using Trojanized versions of popular applications like WhatsApp and Signal. Instead of using zero-day and other exploits, the group simply relied on targets making mistakes and downloading malicious apps on their devices.
The type of data the group has stolen includes location information and call records, text messages, contact information, photos, and audio recordings from infected devices.
The groups mobile attack malware includes Pallas, a custom-developed Android surveillance tool and a previously unseen lawful-intercept mobile surveillance software product from FinFisher.
Dark Caracal uses phishing as its primary attack vector, Flossman says. We uncovered a number of Facebook groups as well as text messages that would phish a user into visiting a third-party party Android App Store called Secure Android, he says.
From here the user would install a working copy of apps such as WhatsApp, Signal, and Telegram, which would work exactly like the real thing but come embedded with the Pallas data-stealing tool. Theres also evidence to suggest that in some cases Dark Caracal infected devices by gaining physical access to them, Flossman says.
While mobile devices appear to be the primary target, Dark Caracal also has tools for breaking into and stealing from Windows and other desktop systems. The group has extensively used Bandook, a Trojan for remotely controlling compromised Windows desktop systems. It also has been using CrossRAT, a previously unknown, multiplatform tool designed to target Windows, OS X, and Linux systems, Lookout said in its report.
Many other threat groups have used, and are continuing to use, portions of the same infrastructure that Dark Caracal used for its cyber-espionage campaign, suggesting that the group could be managing the infrastructure, Lookout and EFF said.
The mixed use of the infrastructure has made attribution very difficult. The seemingly unrelated campaigns originating from the same infrastructure have resulted in security researchers misattributing Dark Caracals work to other threat groups in the past, EFF and Lookout said. One example is EFF itself, which in 2016
attributed
a Dark Caracal campaign to Indian cybersecurity firm Appin.
Most organizations likely do not have to worry about the specific threat posed by Dark Caracal because of how targeted it is, EFF said in a
blog post
. And the groups data-stealing tools for mobile devices are a threat only to individuals who make the mistake of downloading the Trojanized Android apps from unofficial app stores.
Even so, Dark Caracal has wide-reaching implications for how state-sponsored surveillance and malware works. Mobile is the future of spying, because phones are full of so much data about a persons day-to-day life, EFF said in a separate
release
.
So far, there is no evidence to suggest that Dark Caracal has gone after iOS users, probably because it does not have the capabilities or the resources needed to break into and steal from iOS devices, Flossman adds.
Importantly, they haven’t needed to target iOS, he says. Their espionage campaigns targeting Android have been very successful and considering, geographically, where their targets likely reside, it makes sense that they have an Android focus.
Related Content:
Mobile Malware Incidents Hit 100% of Businesses
Malware Pre-Installed On Over Two-Dozen Android Smartphone Brands
In Mobile, Its Back to the Future
6 Ways To Keep Androids Safe

Last News
▸ Security Problem Growing for Dairy Queen, UPS & Retailers, Back off ◂ Discovered: 23/12/2024 Category: security	▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security	▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Dark Caracal Campaign Breaks New Ground with Focus on Mobile Devices