Android Spyware: GravityRAT steals WhatsApp backups

June 25, 2023
| No comments
B2B Cyber ​​Security ShortNews
Advertising

Share post

WhatsApp users should pay close attention to what they download on their Android smartphones. ESET researchers have detected a new Android version of GravityRAT spyware hiding in infected versions of BingeChat and Chatico messaging apps. Since SMEs in particular also like to use private smartphones including WhatsApp, caution is called for.

In the case under investigation, the malicious app steals WhatsApp backups and can also delete files on the devices. In order not to be immediately noticed, the app offers legitimate chat functionality based on the open-source application OMEMO Instant Messenger. ESET suspects the SpaceCobra group behind this campaign, which has probably been active since August 2022.

Advertising

Used in targeted attacks

The malicious BingeChat app is distributed via a website that requires registration and is likely to be opened only when the attackers expect certain victims to visit it. "We found a web page that should provide the malicious app after tapping the DOWNLOAD APP button.

However, visitors must register for this. However, we had no login details and registration was closed. We assume that the operators provide registration only when they expect a specific victim to visit. Potential targets may need a specific IP address, geolocation, custom URL, or need to visit the website at a specific time,” says ESET researcher Lukas Stefanko. The app was never made available on the Google Play Store.

Advertising

The rigged Chatico app targeted a user in India. Overall, the ESET researchers suspect that the campaign is very targeted and that carefully selected targets are being attacked.

Actors behind the campaign unclear

The group behind the malware remains unknown. Facebook researchers and Cisco Tales experts attribute GravityRAT to a Pakistan-based group. ESET monitors these under the name SpaceCobra and traces both the BingeChat and Chatico campaigns to this group.

As part of the legitimate functionality of the apps, they offer account creation and sign-up options. Before the user logs into the app, GravityRAT starts interacting with its C&C server, stealing the device user's data and waiting for commands to be executed. GravityRAT is able to search and exfiltrate call logs, contact lists, SMS messages, device location, basic device information and files with specific extensions for images, photos and documents. This version of GravityRAT has two small updates compared to previous publicly known versions of GravityRAT: exfiltration of WhatsApp backups and receiving commands to delete files.

B2B CYBER SECURITY asked chat GPT for GravityRAT

Here's what ChatGPT wants to know about GravityRAT.

ChatGPT to GravityRAT

GravityRAT is malicious software known as Remote Access Trojan (RAT). RATs are malware programs that allow an attacker to gain unauthorized access to the infected system and control it remotely. Here is some information about the GravityRAT group:

  • Origin: The GravityRAT malware was first discovered in 2015 by a group known as “The Invincible.” The group is believed to be from India, as GravityRAT was primarily used against Indian targets.
  • objective: GravityRAT is designed to perform various malicious activities including spying on victims, gathering information, intercepting keystrokes, capturing screenshots and executing commands on the infected system. It is believed that the main targets of the GravityRAT group were governmental organizations, military establishments, diplomats and research institutions in India.
  • Functionality: GravityRAT malware typically proliferates using fake email attachments or through social engineering methods, in which attackers impersonate trusted organizations or individuals. Once a system is infected, the malware establishes a connection to a command and control server, which attackers can use to access and remotely control the infected system.
  • Activities: The GravityRAT group is known for running India-specific malware campaigns. It has developed different versions of the GravityRAT malware to make it harder to detect and streamline its malicious activities. The malware has evolved over time, introducing new features and techniques.

 

More at ESET.com

 

About ESET

ESET is a European company with headquarters in Bratislava (Slovakia). ESET has been developing award-winning security software since 1987 that has already helped over 100 million users enjoy secure technology. The broad portfolio of security products covers all common platforms and offers companies and consumers worldwide the perfect balance between performance and proactive protection. The company has a global sales network in over 180 countries and branches in Jena, San Diego, Singapore and Buenos Aires. For more information, visit www.eset.de or follow us on LinkedIn, Facebook and Twitter.

 

Matching articles on the topic

Faulty ASUS software allows malware installations 

The pre-installed ASUS DriverHub software contains a critical security vulnerability that allows remote code execution of malware. Due to the faulty checking of ➡ Read more

Play ransomware exploits Windows zero-day vulnerability 

According to Symantec, the Play ransomware group and allied groups are using an exploit that targets the zero-day vulnerability CVE-2025-29824. The vulnerability was ➡ Read more

Samsung server software attacked by exploit

A vulnerability was discovered in Samsung MagicINFO 9 in August 2024. After a research report was published in April, ➡ Read more

MITRE CVE program remains in place for the time being

The CVE program, funded by the US government, is considered a crucial component in the global detection of software flaws. Now, funding is to be temporarily suspended. ➡ Read more

LockBit leak site hacked and data stolen

Now LockBit has also become the victim of another hacker: It seems that not only the leak page of the group was hacked, but ➡ Read more

F5 BIG-IP: BSI warns of highly dangerous vulnerabilities

The BSI has issued a warning about F5 products, as they contain several highly dangerous security vulnerabilities that should be closed. The BIG-IP ➡ Read more

Iran, North Korea, Russia: State hackers rely on ClickFix 

State-sponsored hacker groups are increasingly adopting new social engineering techniques originally developed by commercially motivated cybercriminals. ClickFix, for example, is now increasingly ➡ Read more

TA4557: Venom Spider targets HR departments

TA4557, better known as Venom Spider, is increasingly exploiting phishing and trying to deploy its backdoor malware. The focus of the ➡ Read more

Short news
, , , , ,