Malicious Google Play Apps Linked to SideWinder APT

The active attack involving three malicious Android applications is the first exploiting CVE-2019-2215, Trend Micro researchers report.

Researchers have discovered an attack exploiting CVE-2019-2215, which leverages three malicious apps in the Google Play store to compromise a target device and collect users data.
This threat is linked to the SideWinder advanced persistent threat (APT) group, report Trend Micros Ecular Xu and Joseph Chen in a blog post. Sidewinder, a group
detected
by Kaspersky Labs in the first quarter of 2018, primarily targets Pakistani military infrastructure and has been active since at least 2012. Security researchers believe the threat group is
associated
with Indian espionage interests and has a history of targeting both Windows and Android devices.
CVE-2019-2215 was
disclosed
in October 2019 by Maddie Stone of Googles Project Zero. The zero-day local privilege escalation vulnerability affected hundreds of millions of Android phones at the time it was published. A patch was released in December 2017 for earlier Android versions; however, new source code review indicated newer versions of the software were vulnerable.
The use-after-free vulnerability is considered high severity and requires a target to download a malicious application for potential exploitation. An attacker would have to chain CVE-2019-2215 with another exploit to remotely infect and control a device via the browser or another attack vector. The bug allows for a full compromise of a vulnerable device, Stone explained.
While it was highly likely the bug was being used in attacks last October, this marks the first known active campaign using it in the wild, Xu and Chen report. This particular vulnerability exists in Binder, the main interprocess communication system that exists in Android, and the three malicious apps used in the attack were disguised as photography and file manager tools.
Android apps Camero, FileCrypt Manager, and callCam are believed to be related to the SideWinder group and have been active on Google Play since March 2019, based on one of the apps certificate information. All have since been removed from the Play store.
CallCam is the payload app and is installed in two stages, the
researchers explain
. First a DEX file — an Android file format — is downloaded from the command-and-control server. The downloaded DEX file downloads an APK file and installs it after exploiting the device or employing accessibility. Camero and FileCrypt Manager both act as droppers. After downloading the DEX file from the C2 server, they call extra code to download, install, and launch the callCam app.
Researchers note the C2 servers used are suspected to be part of SideWinders infrastructure. Further, a URL linking to one of the apps Google Play pages is on one of the C2 servers.
SideWinder relies on device rooting as one of its tactics to deploy callCam without alerting the victim. The malware retrieves a specific exploit from the C2 server depending on the DEX the dropper downloads. This approach only works on Google Pixel (Pixel 2 and Pixel 2 XL), Nokia 3 (TA-1032), LG V20 (LG-H990), Oppo F0 (CPH1881), and Redmi 6A devices.
Over the course of its investigation, Trend Micro was able to download five exploits from the C2 server and found they used CVE-2019-2215 and MediaTek-SU to gain root privileges. Once they achieve this, the malware installs callCam, enables accessibility permissions, and launches.
Another approach is using the accessibility permission, a technique used by the FileCrypt Manager on Android phones running Android 1.6 or higher. After launch, FileCrypt asks the user to enable accessibility. When granted, this displays a full-screen overlay that says it requires further setup. In the background, the app is calling code from the DEX file so it can download more apps and install callCam. It enables the accessibility permission and launches the payload.
All of this happens behind the overlay screen, unbeknownst to the user, Xu and Chen write.
After launch, the callCam icon is hidden on the target device and collects data in the background to send to the C2 server. This information includes location, battery status, files stored on the device, list of installed apps, account data, Wi-Fi data, and information related to the device, sensor, and camera. It also pulls data from WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome. CallCam encrypts all of this stolen data using RSA and AES encryption, and uses SHA256 to verify the datas integrity and customize the encoding routine.
Related Content:
6 Traits to Develop for Cybersecurity Success
Rethinking Enterprise Data Defense
Ransomware Victim Southwire Sues Maze Operators
Time for Insider-Threat Programs to Grow Up
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
What Tools Will Find Misconfigurations in My AWS S3 Cloud Buckets?

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Malicious Google Play Apps Linked to SideWinder APT